Codimd
by Hackmd
CVEs (5)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-38354 | Hig | 0.53 | 8.1 | 0.00 | Jul 10, 2024 | CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe `HTML` tags with an improperly sanitized `name` attribute. This vulnerability enables attackers to perform cross-site scripting (XSS) attacks… | ||
| CVE-2024-22778 | Hig | 0.49 | 7.5 | 0.01 | Feb 21, 2024 | HackMD CodiMD <2.5.2 is vulnerable to Denial of Service. | ||
| CVE-2019-15499 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL. | ||
| CVE-2024-38353 | Med | 0.35 | 5.3 | 0.01 | Jul 10, 2024 | CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing an unauthenticated attacker to gain unauthorised access to image data uploaded to CodiMD. CodiMD does not require valid… | ||
| CVE-2025-46654 | Med | 0.32 | 4.9 | 0.00 | Apr 26, 2025 | CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file that references an uploaded .js file. |
- risk 0.53cvss 8.1epss 0.00
CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe `HTML` tags with an improperly sanitized `name` attribute. This vulnerability enables attackers to perform cross-site scripting (XSS) attacks…
- risk 0.49cvss 7.5epss 0.01
HackMD CodiMD <2.5.2 is vulnerable to Denial of Service.
- risk 0.40cvss 6.1epss 0.01
CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL.
- risk 0.35cvss 5.3epss 0.01
CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing an unauthenticated attacker to gain unauthorised access to image data uploaded to CodiMD. CodiMD does not require valid…
- risk 0.32cvss 4.9epss 0.00
CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file that references an uploaded .js file.