Medium severity5.5NVD Advisory· Published Nov 3, 2022· Updated Jun 17, 2026
CVE-2022-41710
CVE-2022-41710
Description
Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Markdownify. This is possible because the application does not have a CSP policy (or at least not strict enough) and/or does not properly validate the contents of markdown files before rendering them.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
electron-markdownifynpm | <= 1.4.1 | — |
Affected products
3- cpe:2.3:a:markdownify_project:markdownify:1.4.1:*:*:*:*:*:*:*
- Markdownify/Markdownifydescription
Patches
Vulnerability mechanics
References
4- fluidattacks.com/advisories/noisestorm/nvdExploitThird Party Advisory
- github.com/advisories/GHSA-qqhf-xfhw-7884ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-41710ghsaADVISORY
- fluidattacks.com/advisories/noisestormghsaWEB
News mentions
0No linked articles in our index yet.