Description
vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe') on Windows and a similar attack on macOS.
Remediation
References
https://github.com/yoshuawuyts/vmd/issues/137
Related Vulnerabilities
CVE-2020-7760 Vulnerability in npm package codemirror
CVE-2020-7238 Vulnerability in maven package io.netty:netty-codec-http
CVE-2022-41777 Vulnerability in npm package nadesiko3
CVE-2020-10992 Vulnerability in maven package com.linkedin.azkaban:azkaban-common
CVE-2020-7656 Vulnerability in maven package org.fujion.webjars:jquery