CVE-2023-53940

Name of the Vulnerable Software and Affected Versions Codigo Markdown Editor version 1.0.1

Description The software contains a code execution issue that permits attackers to execute arbitrary system commands by creating a malicious markdown file. An attacker can embed a video source with an onerror event, which then executes shell commands using the Node.js child process module when the file is opened. The vulnerable component is the handling of markdown files. The onerror event is exploited to trigger the execution of commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.