Eiji Mori

A stored cross-site scripting issue exists in the event handlers of the `pre` tags. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

The issue allows a remote authenticated attacker to execute arbitrary JavaScript code with the privilege of the application on the PC where the affected product is installed, potentially leading to the execution of arbitrary OS commands.

The issue is related to the improper neutralization of JavaScript code. When a file is opened with the affected product, it may result in the execution of JavaScript code contained in the file.

A stored cross-site scripting issue due to improper handling of links with the `javascript:` scheme inside documents may allow an attacker to execute arbitrary scripts on a user's PC.

Name of the Vulnerable Software and Affected Versions: Inkdrop versions prior to v5.3.1 Description: The issue allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code snippet containing an invalid iframe into Inkdrop. Recommendations: For versions prior to v5.3.1, update to version v5.3.1 or later to resolve the issue. As a temporary workaround, consider restricting the loading of files or code snippets containing iframes to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Zettlr versions 0.20.0 through 1.8.8 Description: A cross-site scripting issue allows an attacker to execute an arbitrary script by loading a file or code snippet containing an invalid iframe into the software. Recommendations: For Zettlr versions 0.20.0 through 1.8.8, update to a version that contains a fix for this issue.