Marky Persistent Cross-Site Scripting Vulnerability

A persistent cross-site scripting vulnerability has been identified in Marky version 0.0.1. This vulnerability allows attackers to inject malicious scripts into markdown files. When these crafted markdown files, containing embedded JavaScript payloads, are opened, the scripts execute, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability allows for persistent cross-site scripting, with the injected scripts executing automatically when the affected markdown files are opened. This behavior could be leveraged for remote code execution.

Reproduction

To reproduce this vulnerability, upload a markdown file containing a JavaScript payload into the Marky application. Once the file is opened, the embedded script will execute, demonstrating the cross-site scripting vulnerability. This exploitation could be further extended to achieve remote code execution.