CVE-2019-20374: XSS
A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-20374?
CVE-2019-20374 is a mutation cross-site scripting (XSS) issue in Typora through version 0.9.9.31.2 on macOS and version 0.9.81 on Linux, leading to Remote Code Execution through Mermaid code blocks.
How does CVE-2019-20374 vulnerability occur?
The vulnerability occurs when a file is opened in Typora, triggering the XSS vulnerability due to improper HTML sanitization.
What is the severity of CVE-2019-20374?
CVE-2019-20374 has a severity rating of 9.6, which is classified as critical.
What is the affected software for CVE-2019-20374?
The affected software for CVE-2019-20374 is Typora versions up to 0.9.9.31.2 on macOS and up to 0.9.81 on Linux.
How can I fix CVE-2019-20374?
To fix CVE-2019-20374, users should update to the latest version of Typora that includes the fix for the XSS vulnerability.