Junglewise Threat Intelligence

CVE-2022-41709: Markdownify remote code execution via malicious markdown

CVE-2022-41709 · Severity: low · CVSS 3.1 · Published 2022-10-19

Vendors: npm.

Executive brief

Markdownify is an Electron-based desktop application for viewing and editing markdown files. A flaw in the application's security configuration allows arbitrary code execution when a user opens a specially crafted malicious markdown file, potentially compromising the user's system and data.

Technical details

Markdownify 1.4.1 is vulnerable to remote code execution due to the enabled "nodeIntegration" option in the Electron framework. This setting allows markdown content to execute arbitrary Node.js code with the privileges of the Electron process. The vulnerability is triggered when a user opens a malicious markdown file through the application. An attacker can craft a markdown file containing embedded code that will execute when rendered. No patch has been released and no workarounds are documented.

Affected products

  • Amit Merchant Markdownify up to 1.4.1

Timeline

  • 2022-10-19: disclosed
  • 2022-10-25: other: GitHub security team reviewed advisory

References

Related threats