VulnerabilityModified
CVE-2022-43668
Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript code contained in the file when opening a file with the affected product.
MEDIUM 6.1EPSS 0.36%
Does this matter?
Lower severity and a low EPSS score (0.36%). Track it; it rarely justifies an emergency change on its own.
Description
Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript code contained in the file when opening a file with the affected product.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.36% probability · 29th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- typora/typora
- Source
- vultures@jpcert.or.jp
References
- https://jvn.jp/en/jp/JVN26044739/index.htmlThird Party Advisory
- https://typora.io/releases/allPatch, Release Notes, Vendor Advisory
- https://jvn.jp/en/jp/JVN26044739/index.htmlThird Party Advisory
- https://typora.io/releases/allPatch, Release Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.