CVE-2023-1004

Katalog CVE

CVSS 7.8 · High EPSS 0,38%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada marktext. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in MarkText up to 0.17.1 on Windows and classified as critical. Affected by this vulnerability is an unknown functionality of the component WSH JScript Handler. The manipulation leads to code injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-221737 was assigned to this vulnerability.

Rincian

Terbit di NVD

24 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/marktext/marktext/issues/3575 exploit · issue tracking · advisory pihak ketiga
• https://vuldb.com/?ctiid.221737 permissions required · advisory pihak ketiga
• https://vuldb.com/?id.221737 permissions required · advisory pihak ketiga