Typora Command Injection Vulnerability in PDF Export Preferences

A command injection vulnerability has been identified in Typora version 1.7.4, specifically within the PDF export preferences. This vulnerability allows attackers to execute arbitrary system commands by injecting malicious commands into the 'run command' input field during the PDF export process. Exploitation of this vulnerability could lead to remote code execution.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the system where Typora is running.

Reproduction

To reproduce this vulnerability, open Typora 1.7.4 and navigate to the Preferences menu. Select the PDF export tab and check the 'run command' option. Enter a reverse shell command into the provided input field. After closing the preferences window, return to the File menu, select PDF export, and click Save. The injected command will be executed, establishing a reverse shell connection.