XSS in Jotron Studymd
CVE-2021-47842
StudyMD 0.3.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into markdown files. Attackers can upload crafted markdown files with embedded JavaScript payloads that execute when the file is opened, potentially enabling remote code execution.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (34.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
Affected products
- Jotron Studymd — versions 0.3.2
Weakness classification (CWE)
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2021-47842?
- CVE-2021-47842 is a high-severity vulnerability in Jotron Studymd, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2026-01-16.
- How severe is CVE-2021-47842?
- High severity. CVSS v3 base score is 7.2 out of 10.