Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Aug 31, 2026A vulnerability was found in Typora up to 1.13.8/1.14.6.CVE-2026-82805 · Other software · reported by VulDBLow 2.1
A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of the argument classDef/style results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 1.14.8 is able to resolve this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2025Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system commands.CVE-2024-14010 · Other software · Typora · reported by VulnCheckHigh 8.5
Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system commands. Attackers can inject malicious commands into the 'run command' input field during PDF export to achieve remote code execution.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypora.ioexploit-db.com
Aug 12, 2024Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component.CVE-2024-41482 · Other software · Typora · reported by MITREMedium 6.1
Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the Mermaid component.CVE-2024-41481 · Other software · Typora · reported by MITREMedium 6.1
Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the Mermaid component.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2024Typora v1.0.0 through v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, which allows attackers to execute arbitrary code by uCVE-2024-33300 · Other software · typora · reported by MITREHigh 7.3
Typora v1.0.0 through v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, which allows attackers to execute arbitrary code by uploading Markdown files.
- Product
- typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the src compCVE-2024-31784 · Other software · appmakes.io · reported by MITREMedium 6.1
An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the src component.
- Product
- typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024Cross Site Scripting (XSS) vulnerability in Typora v.1.6.7 and before, allows a local attacker to obtain sensitive information via a crafted script during markdCVE-2024-31783 · Other software · Typora · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in Typora v.1.6.7 and before, allows a local attacker to obtain sensitive information via a crafted script during markdown file creation.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023Cross Site Scripting (XSS) vulnerability found in Typora v.0.9.65 allows a remote attacker to obtain sensitive information via the PDF file exporting function.CVE-2020-18336 · Other software · Typora · reported by MITREHigh 7.4
Cross Site Scripting (XSS) vulnerability found in Typora v.0.9.65 allows a remote attacker to obtain sensitive information via the PDF file exporting function.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbitrary code via uploading a crafted CVE-2023-39703 · Other software · Typora · reported by MITREMedium 6.1
A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbitrary code via uploading a crafted Markdown file.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordc0olw.github.ioc0olw.github.io
Aug 19, 2023Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers CVE-2023-2971 · Other software · Typora · reported by info@starlabs.sgMedium 6.3
Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstarlabs.sgstarlabs.sg
Aug 19, 2023DOM-based XSS in updater/update.html in Typora before 1.6.7 on Windows and Linux allows a crafted markdown file to run arbitrary JavaScript code in the context CVE-2023-2317 · Other software · Typora · reported by info@starlabs.sgHigh 8.6
DOM-based XSS in updater/update.html in Typora before 1.6.7 on Windows and Linux allows a crafted markdown file to run arbitrary JavaScript code in the context of Typora main window via loading typora://app/typemark/updater/update.html in <embed> tag. This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstarlabs.sgsupport.typora.io
Aug 19, 2023Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via CVE-2023-2316 · Other software · Typora · reported by info@starlabs.sgHigh 7.4
Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstarlabs.sgsupport.typora.io
Jun 20, 2023Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax.CVE-2020-21058 · Other software · Typora · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2023A vulnerability, which was classified as critical, was found in Typora up to 1.5.5 on Windows.CVE-2023-1003 · Other software · Typora · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Typora up to 1.5.5 on Windows. Affected is an unknown function of the component WSH JScript Handler. The manipulation leads to code injection. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.8 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221736.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2022Typora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is exported and then used at a victim's oriCVE-2022-40011 · Other software · Typora · reported by MITREMedium 6.1
Typora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is exported and then used at a victim's origin.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comtypora.io
Dec 6, 2022Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript code contained in the file when opening a CVE-2022-43668 · Other software · Typora · reported by vultures@jpcert.or.jpMedium 6.1
Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript code contained in the file when opening a file with the affected product.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2021Cross Site Scripting (XSS) in Typora v0.9.65 allows attackers to execute arbitrary code via mathjax syntax due to a mathjax configuration error in the mathematiCVE-2020-18748 · Other software · Typora · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Typora v0.9.65 allows attackers to execute arbitrary code via mathjax syntax due to a mathjax configuration error in the mathematical formula blocks. This is a different vulnerability from CVE-2020-18221.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2021Cross Site Scripting (XSS) in Typora v0.9.65 and earlier allows remote attackers to execute arbitrary code by injecting commands during block rendering of a matCVE-2020-18221 · Other software · Typora · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Typora v0.9.65 and earlier allows remote attackers to execute arbitrary code by injecting commands during block rendering of a mathematical formula.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2021An issue was discovered in Typora 0.9.67.CVE-2020-18737 · Other software · Typora · reported by MITREMedium 6.1
An issue was discovered in Typora 0.9.67. There is an XSS vulnerability that causes Remote Code Execution.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2020A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid codCVE-2019-20374 · Other software · Typora · reported by MITRECritical 9.6
A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2019Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ oCVE-2019-12172 · Other software · Typora · reported by MITREHigh 7.8
Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2019Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note.CVE-2019-12137 · Other software · Typora · reported by MITREHigh 7.8
Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 31, 2019typora through 0.9.64 has XSS, with resultant remote command execution, during inline rendering of a mathematical formula.CVE-2019-7296 · Other software · Typora · reported by MITREMedium 6.1
typora through 0.9.64 has XSS, with resultant remote command execution, during inline rendering of a mathematical formula.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2019typora through 0.9.63 has XSS, with resultant remote command execution, during block rendering of a mathematical formula.CVE-2019-7295 · Other software · Typora · reported by MITREMedium 6.1
typora through 0.9.63 has XSS, with resultant remote command execution, during block rendering of a mathematical formula.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2019typora through 0.9.9.20.3 beta has XSS, with resultant remote command execution, via the left outline bar.CVE-2019-6803 · Other software · Typora · reported by MITREMedium 6.1
typora through 0.9.9.20.3 beta has XSS, with resultant remote command execution, via the left outline bar.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.