Eiji Mori

**Name of the Vulnerable Software and Affected Versions** GROWI versions prior to v6.0.0 **Description** A stored cross-site scripting issue exists in the event handlers of the `pre` tags. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product. **Recommendations** For GROWI versions prior to v6.0.0, update to version v6.0.0 or later to resolve the issue. As a temporary workaround, consider disabling the event handlers of the `pre` tags until a patch is available. Restrict access to the `pre` tags to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Beekeeper Studio versions prior to 3.9.9 **Description** The issue allows a remote authenticated attacker to execute arbitrary JavaScript code with the privilege of the application on the PC where the affected product is installed, potentially leading to the execution of arbitrary OS commands. **Recommendations** For versions prior to 3.9.9, update to version 3.9.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the application to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Typora versions prior to 1.4.4 **Description** The issue is related to the improper neutralization of JavaScript code. When a file is opened with the affected product, it may result in the execution of JavaScript code contained in the file. **Recommendations** For versions prior to 1.4.4, update to version 1.4.4 or later to resolve the issue. As a temporary workaround, consider avoiding the opening of files that may contain JavaScript code until the update is applied.

**Name of the Vulnerable Software and Affected Versions** marktext versions prior to v0.17.0 **Description** A stored cross-site scripting issue due to improper handling of links with the `javascript:` scheme inside documents may allow an attacker to execute arbitrary scripts on a user's PC. **Recommendations** For marktext versions prior to v0.17.0, update to version v0.17.0 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Inkdrop versions prior to v5.3.1 Description: The issue allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code snippet containing an invalid iframe into Inkdrop. Recommendations: For versions prior to v5.3.1, update to version v5.3.1 or later to resolve the issue. As a temporary workaround, consider restricting the loading of files or code snippets containing iframes to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Zettlr versions 0.20.0 through 1.8.8 Description: A cross-site scripting issue allows an attacker to execute an arbitrary script by loading a file or code snippet containing an invalid iframe into the software. Recommendations: For Zettlr versions 0.20.0 through 1.8.8, update to a version that contains a fix for this issue.