XSS in Marktext
CVE-2020-27176
Mutation XSS exists in Mark Text through 0.16.2 that leads to Remote Code Execution. NOTE: this might be considered a duplicate of CVE-2020-26870; however, it can also be considered an issue in the design of the "source code mode" feature, which parses HTML even though HTML support is not one of the primary advertised roles of the product.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.019 (77.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H.
Affected products
- Marktext
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-27176?
- CVE-2020-27176 is a high-severity vulnerability in Marktext, classified under Cross-site Scripting. CVSS score: 8.3/10. Published 2020-10-16.
- How severe is CVE-2020-27176?
- High severity. CVSS v3 base score is 8.3 out of 10.