CVE-2023-1004

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-1004

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1004.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-1004

Published

2023-02-24T07:56:07.099Z

Modified

2026-07-08T07:16:35.817255821Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

MarkText WSH JScript code injection

Details

A vulnerability has been found in MarkText up to 0.17.1 on Windows and classified as critical. Affected by this vulnerability is an unknown functionality of the component WSH JScript Handler. The manipulation leads to code injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-221737 was assigned to this vulnerability.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1004.json"
}

References

Affected packages

Git / github.com/marktext/marktext

Affected ranges

Type

GIT

Repo

https://github.com/marktext/marktext

Events

Introduced

637395a1f78278e375e0753c7b18e7833a6b9d58

Last affected

c8aa33ddcd41184ecac3bd5e67451569b32d8e38

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0.17.0"
        },
        {
            "last_affected": "0.17.0"
        },
        {
            "introduced": "0.17.1"
        },
        {
            "last_affected": "0.17.1"
        },
        {
            "introduced": "0"
        }
    ],
    "cpe": "cpe:2.3:a:marktext:marktext:*:*:*:*:*:*:*:*"
}

Affected versions

0.*

0.17.0

0.17.1

v0.*

v0.17.0

v0.17.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1004.json"