Description
vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe') on Windows and a similar attack on macOS.
Remediation
References
https://github.com/yoshuawuyts/vmd/issues/137
Related Vulnerabilities
CVE-2023-42276 Vulnerability in maven package cn.hutool:hutool-core
CVE-2022-45400 Vulnerability in maven package org.jvnet.hudson.plugins:japex
CVE-2012-0391 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2021-30638 Vulnerability in maven package org.apache.tapestry:tapestry-core