CVE-2019-20374 - CVE House
Back to Database
Status published High CVE-2019-20374

A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2...

Vulnerability Description

A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-20374

Credits & Attribution

No credits recorded in the NVD database.

References

More from typora

View All →
CVE-2022-40011
Typora through 1.3.8 allows XSS if a document containing an...
Unknown 0
CVE-2020-21058
Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote...
Unknown 0
CVE-2020-18748
Cross Site Scripting (XSS) in Typora v0.9.65 allows attackers to...
Medium 6.1
CVE-2020-18737
An issue was discovered in Typora 0.9.67. There is an...
Medium 6.1
CVE-2020-18336
Cross Site Scripting (XSS) vulnerability found in Typora v.0.9.65 allows...
High 7.4

Affected Vendor

Affected Software

typora
Vulnerable Versions:
0

Timeline

Official Publish: January 9th, 2020
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.