Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Typora 1.6.7 Clear all filters
TI-2023-02173 CVE-2023-2317 · GHSA-vwv2-9jpv-577p

Typora DOM-Based Cross-site Scripting leading to Remote Code Execution

Priority HIGH 76

DOM-based XSS in updater/update.html in Typora before 1.6.7 on Windows and Linux allows a crafted markdown file to run arbitrary JavaScript code in the context of Typora main window via loading typora://app/typemark/upda…

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.02442 Published 2023-08-19 Fixed in 1.6.7 CWE-79
TI-2023-02172 CVE-2023-2316 · GHSA-9f2q-mg3j-68hc

Typora Local File Disclosure

Priority HIGH 66

Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/<absolute-path>".

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00661 Published 2023-08-19 Fixed in 1.6.7 CWE-22