Moderate severityNVD Advisory· Published Nov 3, 2022· Updated May 5, 2025
CVE-2022-41710
CVE-2022-41710
Description
Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Markdownify. This is possible because the application does not have a CSP policy (or at least not strict enough) and/or does not properly validate the contents of markdown files before rendering them.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
electron-markdownifynpm | <= 1.4.1 | — |
Affected products
2- Markdownify/Markdownifydescription
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.