PT-2022-25166 · Typora · Typora

Wangking1 · Published 2022-12-23 · Updated 2026-02-23 · CVE-2022-40011

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions typora versions through 1.38

Description The issue allows remote attackers to run arbitrary code via export from the editor, which is a result of a Cross Site Scripting (XSS) vulnerability. This enables attackers to execute malicious scripts on the client-side.

Recommendations For versions through 1.38, update to a version that contains a fix for this issue to prevent remote attackers from running arbitrary code via export from the editor. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-40011

Affected Products

Typora

References · 10

• 🔥 https://gist.github.com/wangking1/61bdd1967367301a950ffbb3d10386f3 · Exploit
• https://osv.dev/vulnerability/CVE-2022-40011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40011 · Security Note
• http://typora.com · Note
• https://t.me/cvenotify/40569 · Telegram Post
• https://t.me/cveNotify/152853 · Telegram Post
• https://typora.io/releases/all · Note
• http://wwwtyporaio.com · Note
• https://t.me/cveNotify/146733 · Telegram Post
• https://t.me/cibsecurity/55272 · Telegram Post