Description
vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe') on Windows and a similar attack on macOS.
Remediation
References
https://github.com/yoshuawuyts/vmd/issues/137
Related Vulnerabilities
CVE-2023-30527 Vulnerability in maven package org.jenkins-ci.plugins:wso2id-oauth
CVE-2021-21422 Vulnerability in npm package mongo-express
CVE-2023-46499 Vulnerability in npm package @evershop/evershop
CVE-2021-28092 Vulnerability in maven package org.webjars.npm:is-svg
CVE-2023-37945 Vulnerability in maven package io.jenkins.plugins:miniorange-saml-sp