Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-4wx8-5gm2-2j97
No affected components available
Summary
The Markdown preview function of File Browser v2.32.0 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser
Impact
A user can upload a malicious Markdown file to the application which can contain arbitrary HTML code. If another user within the same scope clicks on that file, a rendered preview is opened. JavaScript code that has been included will be executed.
Malicious actions that are possible include:
- Obtaining a user's session token
- Elevating the attacker's privileges, if the victim is an administrator (e.g., gaining command execution rights)
Vulnerability Description
Most Markdown parsers accept arbitrary HTML in a document and try rendering it accordingly. For instance, if one creates a file called xss.md with the following content:
# Hallo
<b>foo</b>
<img src="xx" onerror=alert(9)>
<i>bar</i>
Bold and italic text will be rendered. Also, the renderer used in File Browser will try to display the image and execute the code in the onerror event handler.
Proof of Concept
The screenshot shows that the code from the file mentioned above has actually been executed in the victim's browser:
Recommended Countermeasures
The most thorough fix would be to reconfigure the application's Markdown parser to ignore all HTML elements and only render rich text which is part of the Markdown specification. If HTML rendering is considered to be a required feature, an HTML sanitizer like DOMPurify should be used, preferably in conjunction with a Content Security Policy (CSP).
Timeline
2025-03-25Identified the vulnerability in version 2.32.02025-04-11Contacted the project2025-04-18Vulnerability disclosed to the project2025-06-25Uploaded advisories to the project's GitHub repository2025-06-26CVE ID assigned by GitHub2025-06-26Fix released with version 2.33.7
References
Credits
- Mathias Tausig (SBA Research)
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. The attacker needs the user to perform some action, like clicking a link. The vulnerability can affect other systems as well, not just the initial system. There is a high impact on the confidentiality of the information. There is a low impact on the integrity of the data.
Exploitation activity has been observed. Apply available patches or mitigations urgently.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard