CVE-2019-20374

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 9, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-203756.1A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTMLCVE-2019-203766.1A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTMLCVE-2019-203776.1TopList before 2019-09-03 allows XSS via a title.CVE-2019-203786.1ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter.CVE-2019-203796.1ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter.CVE-2019-20385.5In rw_i93_process_sys_info of rw_i93.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local inforCVE-2019-203816.1TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incCVE-2019-203823.5QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resultingCVE-2019-203837.8ABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows escalation of privileges by local users via CVE-2019-203845.5Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging accCVE-2019-203858.8The CSV upload feature in /supervisor/procesa_carga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/CVE-2019-203862.4An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory