Priority HIGH 70
CodiMD allows realtime collaborative markdown notes on all platforms.
HackMD
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
HackMD records in CISA KEVNo HackMD vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
Priority MEDIUM 63
CodiMD allows realtime collaborative markdown notes on all platforms.
TI-2025-29350 CVE-2025-46655 · GHSA-64gv-p96g-gqxj
CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded…
Priority MEDIUM 56
CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain cases of different-origin file storage, such as AWS S3.
TI-2025-29349 CVE-2025-46654 · GHSA-4r7r-xfq3-2r3v
CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded…
Priority MEDIUM 56
CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file that references an uploaded .js file.
TI-2024-15132 CVE-2024-22778 · GHSA-hpjc-53pc-jh5v
HackMD CodiMD <2.5.2 is vulnerable to Denial of Service.
Priority MEDIUM 40
HackMD CodiMD <2.5.2 is vulnerable to Denial of Service.
TI-2019-11602 CVE-2019-15499 · GHSA-29jh-ww6h-mpqh
CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with…
Priority LOW 29
CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL.