PT-2024-29585 · Note Mark · Note Mark

Alessio-Romano + 1 · Published 2024-07-29 · Updated 2026-04-13 · CVE-2024-41819

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Note Mark versions prior to 0.13.1

Description A stored cross-site scripting issue allows attackers to execute arbitrary web scripts via a crafted payload injected into the URL value of a link in the markdown content.

Recommendations For versions prior to 0.13.1, update to version 0.13.1 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-41819

GHSA-RM48-9MQF-8JC3

Affected Products

Note Mark

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41819.json · Exploit
• 🔥 https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48-9mqf-8jc3 · Exploit
• https://github.com/enchant97/note-mark/commit/a0997facb82f85bfb8c0d497606d89e7d150e182 · Patch
• https://osv.dev/vulnerability/CVE-2024-41819 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41819 · Security Note
• https://twitter.com/dailycve/status/2043788179308720536 · Twitter Post