PT-2022-27377 · Unknown · Markdown Preview Enhanced

Yuriisanin · CVE-2022-45026 · Published 2022-12-07 · Updated 2022-12-08

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Markdown Preview Enhanced versions 0.6.5 through 0.19.6

Description An issue allows attackers to execute arbitrary commands during the GFM export process.

Recommendations For versions 0.6.5 through 0.19.6, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-45026

Affected Products

Markdown Preview Enhanced

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45026.json · Exploit
• 🔥 https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/640 · Exploit
• https://osv.dev/vulnerability/CVE-2022-45026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45026 · Security Note