CVE-2022-41709

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-41717.5The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due CVE-2022-417105.5Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicio CVE-2022-417119.8Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because th CVE-2022-417126.5Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does n CVE-2022-417135.3deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the applicat CVE-2022-417145.3fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the applica CVE-2022-417157.5Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed re CVE-2022-417167.5Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exe CVE-2022-417175.3An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP he CVE-2022-417197.5Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.CVE-2022-41726.5An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_ers CVE-2022-417207.5On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of