PT-2025-52319 · Unknown · Codigo Markdown Editor

8Bitsec · Published 2025-12-18 · Updated 2025-12-19 · CVE-2023-53940

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Codigo Markdown Editor version 1.0.1

Description The software contains a code execution issue that permits attackers to execute arbitrary system commands by creating a malicious markdown file. An attacker can embed a video source with an onerror event, which then executes shell commands using the Node.js child process module when the file is opened. The vulnerable component is the handling of markdown files. The onerror event is exploited to trigger the execution of commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-53940

Affected Products

Codigo Markdown Editor

References · 6

• 🔥 https://exploit-db.com/exploits/51432 · Exploit
• https://osv.dev/vulnerability/CVE-2023-53940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53940 · Security Note
• https://github.com/alfonzm/codigo-app · Note
• https://vulncheck.com/advisories/codigo-markdown-editor-electron-arbitrary-code-execution-via-markdown-file · Note
• https://twitter.com/CVEnew/status/2002104297484435632 · Twitter Post