PT-2022-27376 · Microsoft+1 · Vscode+1

Yuriisanin · Published 2022-12-07 · Updated 2023-08-08 · CVE-2022-45025

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Markdown Preview Enhanced versions 0.6.5 through 0.19.6 for VSCode and Atom

Description A command injection issue was discovered via the PDF file import function.

Recommendations For versions 0.6.5 through 0.19.6, consider disabling the PDF file import function until a patch is available. Restrict access to the import module to minimize the risk of exploitation. Avoid using the PDF import feature in the affected versions until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-45025

Affected Products

Atom

Vscode

References · 6

• 🔥 https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/639 · Exploit
• 🔥 https://github.com/yuriisanin/CVE-2022-45025 · Exploit
• https://osv.dev/vulnerability/CVE-2022-45025 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45025 · Security Note
• https://t.me/cvenotify/39335 · Telegram Post
• https://t.me/cybersecuritytechnologies/7348 · Telegram Post