Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2019-20374 Details

Description

A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/cure53/DOMPurify/commit/4e8af7b2c4a159b683d317e02c5cbddb86dc4a0e CVEPatchThird Party Advisory
https://github.com/typora/typora-issues/issues/3124 CVEThird Party Advisory
https://github.com/cure53/DOMPurify/commit/4e8af7b2c4a159b683d317e02c5cbddb86dc4a0e [email protected]PatchThird Party Advisory
https://github.com/typora/typora-issues/issues/3124 [email protected]Third Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')[email protected]

Affected Products

ProductVersions
typora typora
<= 0.9.81
<= 0.9.9.31.2

CPE

  • cpe:2.3:a:typora:typora:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
linux linux kernel
All versions

CPE

  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
apple macos
All versions

CPE

  • cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

5 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2019-20374
NVD Published Date:
Jan 9, 2020
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2019-20374 Details - Not Deferred