Markdownify subject to Remote Code Execution via malicious markdown file

HIGH 7.8CVE-2022-41709 · GHSA-c942-mfmp-p4fh · Published 19/10/2022 · updated 17/06/2026

In short

CVE-2022-41709 is a HIGH (CVSS 7.8) vulnerability affecting markdownify (markdownify project), electron-markdownify.
Chance of exploitation in the next 30 days (EPSS): 0.48%, higher than 41.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
markdownify markdownify_project	`= 1.4.1`	No fix yet
electron-markdownify npm	`≤ 1.4.1`	No fix yet

Description

Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled. There are currently no patched versions and no known workarounds.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-41709 · ADVISORY
fluidattacks.com/advisories/adams · WEB
amitmerchant1990/electron-markdownify · PACKAGE
fluidattacks.com/advisories/adams · Exploit

More vulnerabilities in markdownify

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

markdownify

markdownify_project

= 1.4.1

No fix yet

electron-markdownify

npm

≤ 1.4.1

No fix yet

Description

NVD description