Markdown Explorer Cross-Site Scripting Vulnerability Allowing Remote Code Execution

A cross-site scripting vulnerability has been identified in Markdown Explorer version 0.1.1. This issue allows attackers to inject malicious JavaScript payloads through file uploads and editor inputs. When the injected markdown files are opened, the embedded scripts are executed, potentially leading to unauthorized access and execution of commands on the victim's system.

Impact

Exploitation of this vulnerability allows for cross-site scripting, with the injected scripts executed in the context of the user.

Reproduction

To reproduce this vulnerability, upload a markdown file containing a JavaScript payload through the application's file upload feature. Alternatively, inject a script into the editor input. Once the file is opened or the editor input is viewed, the payload will execute, demonstrating the cross-site scripting vulnerability.