Anote Persistent Cross-Site Scripting Vulnerability Leading to Remote Code Execution

A persistent cross-site scripting vulnerability has been identified in Anote version 1.0. This vulnerability allows attackers to execute arbitrary code by injecting malicious JavaScript payloads into markdown files within the application. When these files are opened, the embedded scripts execute system commands, potentially leading to remote code execution on the user's computer.

Impact

Exploitation of this vulnerability allows for persistent cross-site scripting, with injected scripts executing in the context of the user.

Reproduction

To reproduce this vulnerability, create a markdown file and inject a JavaScript payload that executes a system command. Once the file is saved and opened in Anote, the injected script will execute, performing the specified command on the system.