GCVE - cpe:2.3:a:markdownify_project:markdownify:1.4.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:markdownify_project:markdownify:1.4.1:*:*:*:*:*:*:*

part: a version: 1.4.1 update: *

Vendor	Markdownify Project (`370be849-02cd-5ced-8d0f-028cefdf9035`)
Product	Markdownify (`41ca66f2-d968-550d-b6bd-1e059a86a958`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL	Source	Last updated
`pkg:github/amitmerchant1990/electron-markdownify`	purl2cpe	2026-06-01 10:16:55.007961
`pkg:gitlab/lwbrown/electron-markdownify`	purl2cpe	2026-06-01 10:16:55.007964
`pkg:sourceforge/markdownify.mirror`	purl2cpe	2026-06-01 10:16:55.007967

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-41710`	vulnerable	2026-06-08 05:48:30.833194	Details available Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Markdownify. This is possible because the application does not have a CSP policy (or at least not strict enough) and/or does not properly validate the contents of markdown files before rendering them. Published: 2022-11-03T00:00:00.000Z Updated: 2025-05-05T13:26:00.910Z Open on db.gcve.eu Reference links https://github.com/amitmerchant1990/electron-markdownify https://fluidattacks.com/advisories/noisestorm/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-41709`	vulnerable	2026-06-08 05:48:30.832727	Details available Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled. Published: 2022-10-19T00:00:00.000Z Updated: 2025-05-08T20:04:07.255Z Open on db.gcve.eu Reference links https://fluidattacks.com/advisories/adams/ https://github.com/amitmerchant1990/electron-markdownify	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.