~ / search / GHSA-pfr3-87q3-65rc

GHSA-pfr3-87q3-65rc

Cross-site Scripting in vmd

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-33041

Packages

EcosystemPackageAffectedFixed in
npm vmd <= 1.34.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

vmd through 1.34.0 allows `div class="markdown-body"` XSS, as demonstrated by Electron remote code execution via `require('child_process').execSync('calc.exe')` on Windows and a similar attack on macOS.

References

External links from the advisory. They lead to third-party sites.