| Название | Typora <=1.13.7 Code Injection |
|---|
| Описание | A remote code execution vulnerability exists in Typora version 1.13.7 and earlier. The vulnerability stems from the built-in Mermaid diagram rendering engine, which fails to adequately validate and sanitize user-supplied style values in classDef and style statements. Additionally, Typora configures Mermaid with securityLevel: "loose", which bypasses the final DOMPurify sanitization step during the rendering process.
An attacker can craft a malicious Markdown file containing a Mermaid code block and inject a </style> tag within the style value of a classDef or style statement, thereby closing the <style> element inside the SVG and subsequently injecting arbitrary HTML tags. The Mermaid lexer employs loose regular expressions such as [^\n]* to match style values in several diagram types, imposing no restriction on < and > characters, which allows the malicious payload to pass the parsing phase. The style value is then concatenated into a CSS rule string and written directly to the DOM via the innerHTML property without HTML entity encoding, providing an entry point for tag injection.
Under the securityLevel:"loose" configuration, the final DOMPurify sanitization step is skipped, leaving injected malicious HTML tags such as <img onerror="..."> intact in the DOM structure. When the browser parses the SVG, the <img> tag triggers its onerror event due to a failed image load, executing the attacker's injected JavaScript code. Furthermore, Typora exposes window.reqnode = window.require in the renderer process's window.html, enabling the injected JavaScript to invoke Node.js child_process module and execute arbitrary system commands on the target host. Consequently, the attack chain escalates from HTML injection to full remote code execution.
This vulnerability requires no user interaction beyond opening the malicious Markdown file in Typora and affects all major platforms including Windows, Linux, and macOS. The affected Mermaid diagram types include stateDiagram-v2, stateDiagram, block-beta, treemap-beta, and classDiagram, providing multiple attack entry vectors. |
|---|
| Источник | ⚠️ https://github.com/zzk6th/cve/issues/5 |
|---|
| Пользователь | z0ng (UID 96775) |
|---|
| Представление | 19.06.2026 08:56 (2 месяцы назад) |
|---|
| Модерация | 31.08.2026 06:30 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 397225 [Typora до 1.13.8/1.14.6 Mermaid Rendering Engine classDef/style межсайтовый скриптинг] |
|---|
| Баллы | 20 |
|---|