TI-2024-25612 Aliases CVE-2024-38354

Cross-site Scripting in Hackmd.io Notes lead by HTML Injection

HIGH 70CWE-79Published 2024-07-10 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe `HTML` tags with an improperly sanitized `name` attribute. This vulnerability enables attackers to perform cross-site scripting (XSS) attacks via DOM clobbering. This vulnerability is fixed in 2.5.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00421 36th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed codimd (hackmdio): 2.5.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
hackmdio	codimd	before 2.5.4	2.5.4	Patch available	CNA

codimd Vendorhackmdio Affected before 2.5.4 Fixed in 2.5.4 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hackmd:codimd::::::::	before 2.5.4	Vulnerable	HackMD

cpe:2.3:a:hackmd:codimd:*:*:*:*:*:*:*:* Versions before 2.5.4 Vulnerable ·HackMD

Remediation

Fix · CNA codimd (hackmdio) Fixed in 2.5.4

Timeline

2026-10-02 Threatist record created from CVE-2024-38354

References

Exploit 1

https://github.com/hackmdio/codimd/security/advisories/GHSA-22jv-vch8-2vp9

TI-2024-25611 CodiMD - Missing Image Access Controls and Unauthorized Image Access CVSS 3.1MEDIUM 5.3
TI-2025-29349 CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded… CVSS 3.1MEDIUM 4.9
TI-2024-15132 HackMD CodiMD <2.5.2 is vulnerable to Denial of Service. CVSS 3.1HIGH 7.5
TI-2019-11602 CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences