CVE-2021-33041

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe') on Windows and a similar attack on macOS.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/yoshuawuyts/vmd/issues/137Exploit, Issue Tracking, Third Party Advisory
https://github.com/yoshuawuyts/vmd/issues/137Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: May 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-330449.8The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity CVE-2021-330459.8The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity CVE-2021-330469.8Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specif CVE-2021-33057.8Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability.CVE-2021-330547.5SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with n CVE-2021-330559.8Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.CVE-2021-330567.5Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message.CVE-2021-330577.5The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) fo CVE-2021-330587.8Improper access control in the installer Intel(R)Administrative Tools for Intel(R) Network Adaptersfor Windowsbefore version 1.4.0.21 may al CVE-2021-330596.7Improper input validation in the Intel(R) Administrative Tools for Intel(R) Network Adapters driver for Windows before version 1.4.0.15, may CVE-2021-330607.8Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of pr CVE-2021-330615.5Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially