Hackmd Codimd
6 CVEs affecting Hackmd Codimd. Latest disclosed: 2025-04-26. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-38354 | High | 8.1 | 2024-07-10 | CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe `HTML` tags with an imp… |
CVE-2024-22778 | High | 7.5 | 2024-02-21 | HackMD CodiMD <2.5.2 is vulnerable to Denial of Service. |
CVE-2019-15499 | Medium | 6.1 | 2019-08-23 | CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL. |
CVE-2024-38353 | Medium | 5.3 | 2024-07-10 | CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing a… |
CVE-2025-46655 | Medium | 4.9 | 2025-04-26 | CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain c… |
CVE-2025-46654 | Medium | 4.9 | 2025-04-26 | CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file tha… |