CVE-2024-38354

MEDIO 6.1CVE-2024-38354 · Published 10/07/2024 · updated 17/06/2026

En resumen

CVE-2024-38354 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a codimd (hackmd).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.42%, mayor que el 36.6% de las vulnerabilidades.
Solución: actualizar a 2.5.4 o posterior.

Package	Affected versions	Patched versions
codimd hackmd	`< 2.5.4`	`2.5.4`

Description

CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe `HTML` tags with an improperly sanitized `name` attribute. This vulnerability enables attackers to perform cross-site scripting (XSS) attacks via DOM clobbering. This vulnerability is fixed in 2.5.4.

References

hackmdio/codimd security advisory · Exploit

Más vulnerabilidades de codimd

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free