CVE-2022-25224

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-25224

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25224.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-25224

Published

2022-05-20T11:04:12Z

Modified

2026-07-15T01:49:02.449399560Z

Summary

[none]

Details

Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.2.0"
                },
                {
                    "last_affected": "0.2.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "Fluid Attacks",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25224.json"
}

References

Affected packages

Git / github.com/steventhanna/proton

Affected ranges

Type

GIT

Repo

https://github.com/steventhanna/proton

Events

Introduced

b99c56a0aa2d3d2032906977cf0d7f70d3df4c12

Last affected

b99c56a0aa2d3d2032906977cf0d7f70d3df4c12

Database specific

{
    "cpe": "cpe:2.3:a:proton_project:proton:0.2.0:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "0.2.0"
        },
        {
            "last_affected": "0.2.0"
        }
    ]
}

Affected versions

0.*

0.2.0

v0.*

v0.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25224.json"