CVE-2026-82805 in Typora
Summary
by MITRE • 08/31/2026
A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of the argument classDef/style results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 1.14.8 is able to resolve this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified within Typora versions up through 1.13.8 and 1.14.6 represents a significant security flaw located specifically within the Mermaid Rendering Engine component. This open-source diagramming tool is integrated into Typora to allow users to create flowcharts, sequence diagrams, Gantt charts, and other visual representations directly within their markdown documents. The core of the issue lies in how the application processes specific arguments passed to the rendering engine, particularly those related to class definitions and style attributes. When a user or an attacker provides maliciously crafted input for these parameters, the application fails to properly sanitize or validate the data before passing it to the underlying JavaScript execution context responsible for generating the visual output. This lack of adequate input validation allows for the injection of arbitrary script code into the rendered document view.
This technical flaw is classified as a Cross-Site Scripting vulnerability, which aligns with CWE-79 in the Common Weakness Enumeration standard. In this specific implementation, the attack vector involves manipulating the classDef or style arguments within Mermaid syntax blocks embedded in markdown files. Because Typora renders these documents locally and often displays them in an environment that may have access to local file systems or browser-like APIs depending on the underlying framework version, the impact extends beyond simple text display. The injected scripts execute with the privileges of the application context, potentially allowing an attacker to perform actions such as stealing session cookies, capturing keystrokes, defacing the user interface, or redirecting the user to malicious external sites if the rendered content is subsequently shared or viewed in a web-based environment that inherits similar rendering behaviors.
The operational impact of this vulnerability is substantial due to its remote nature and the ease with which it can be exploited. Since Typora is widely used for technical documentation, academic writing, and collaborative projects, users frequently open documents received from external sources. An attacker could distribute a malicious markdown file containing the crafted Mermaid code block. Upon opening or rendering this document in an affected version of Typora, the embedded script would execute automatically without requiring further user interaction beyond viewing the content. The fact that public exploits have been made available significantly lowers the barrier to entry for attackers, enabling less sophisticated threat actors to leverage this flaw against targeted individuals or organizations relying on Typora for their documentation workflows.
Mitigation strategies primarily focus on immediate software updates and cautious document handling practices. The vendor has acknowledged the issue with professional responsiveness and released version 1.14.8, which includes patches that properly sanitize inputs within the Mermaid rendering engine to prevent script injection. Users are strongly advised to upgrade to this fixed version or any subsequent release where the vulnerability is confirmed resolved. In addition to updating software, users should adopt a zero-trust approach when opening markdown files from untrusted sources, particularly those containing complex diagramming syntax like Mermaid blocks. While client-side mitigations such as Content Security Policy headers are often used in web applications, desktop applications rely heavily on proper input validation and output encoding within their rendering engines to prevent execution of unauthorized code.
From a threat intelligence perspective, this vulnerability can be mapped to the MITRE ATT&CK framework under techniques related to Client-Side Scripting Injection. The attack pattern involves delivering malicious content via a common file format that is trusted by the victim application. This highlights the importance of securing third-party libraries and rendering engines embedded within desktop applications. As developers continue to integrate powerful visualization tools like Mermaid into productivity software, rigorous security testing of these components becomes critical. Future development cycles should prioritize static analysis and dynamic fuzzing specifically targeting syntax parsers for diagramming languages to ensure that special characters are correctly escaped or rejected before they reach the execution layer. By maintaining up-to-date software and remaining vigilant against suspicious document content, users can effectively mitigate the risks associated with this class of vulnerabilities.