Executive brief
Markdownify is an Electron-based application used to view and convert markdown files to other formats. A flaw in how the application renders markdown files allows an attacker to craft a malicious markdown file that, when opened by a user, can read arbitrary local files from the victim's computer. This could expose sensitive documents, configuration files, or other confidential data stored on the user's system.
Technical details
The vulnerability exists in Markdownify version 1.4.1 due to insufficient input validation and a missing or overly permissive Content Security Policy (CSP). An attacker can craft a malicious markdown file that leverages the lack of proper sanitization to perform local file reads on the victim's machine. The attack requires user interaction—specifically, the victim must open the malicious markdown file in Markdownify. The vulnerability is classified as CWE-552 (Files or Directories Accessible to External Parties) and allows remote arbitrary local file disclosure. Patches or fixes should involve implementing a strict CSP and properly validating/sanitizing markdown content before rendering.
Affected products
- Amit Merchant electron-markdownify 1.4.1 and earlier
Timeline
- 2022-11-04: disclosed
- 2022-11-03: advisory