CVE-2023-2318 — MarkText DOM-Based Cross-site Scripting leading to Remote Code Execution
DOM-based XSS in src/muya/lib/contentState/pasteCtrl.js in MarkText 0.17.1 and before on Windows, Linux and macOS allows arbitrary JavaScript code to run in the context of MarkT…
Published: 2023-08-19 · CVSS: 8.6 · CVSS 3.1
DOM-based XSS in src/muya/lib/contentState/pasteCtrl.js in MarkText 0.17.1 and before on Windows, Linux and macOS allows arbitrary JavaScript code to run in the context of MarkText main window. This vulnerability can be exploited if a user copies text from a malicious webpage and paste it into MarkText.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7