VULNERABILITY INTELLIGENCE

CVE-2023-2318

CVSS score8.6 HIGH

EPSS probability0.54%

CISA KEVNot currently listed

Published2023-08-19

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Description

DOM-based XSS in src/muya/lib/contentState/pasteCtrl.js in MarkText 0.17.1 and before on Windows, Linux and macOS allows arbitrary JavaScript code to run in the context of MarkText main window. This vulnerability can be exploited if a user copies text from a malicious webpage and paste it into MarkText.

Weakness classification

info@starlabs.sg: CWE-79
nvd@nist.gov: CWE-79

Primary references

info@starlabs.sg — Exploit, Issue Tracking
info@starlabs.sg — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory