What is GHSA-c942-mfmp-p4fh?

GHSA-c942-mfmp-p4fh is a security advisory published by GitHub Security Advisories with High severity. Markdownify subject to Remote Code Execution via malicious markdown file

Which CVE IDs does GHSA-c942-mfmp-p4fh cover?

GHSA-c942-mfmp-p4fh covers the following CVE IDs: CVE-2022-41709. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c942-mfmp-p4fh?

GHSA-c942-mfmp-p4fh has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

Which products are affected by GHSA-c942-mfmp-p4fh?

GHSA-c942-mfmp-p4fh affects 1 product, including: npm/electron-markdownify:\u003c= 1.4.1.

GHSA-c942-mfmp-p4fhHighCVSS 7.8

Markdownify subject to Remote Code Execution via malicious markdown file

Vendor

GitHub Security Advisories

Published

October 19, 2022

Last Modified

May 8, 2025

🔗 CVE IDs covered (1)

CVE-2022-41709 →

📋 Description

Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled. There are currently no patched versions and no known workarounds.

🎯 Affected products1

npm/electron-markdownify:<= 1.4.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-41709
https://github.com/amitmerchant1990/electron-markdownify
https://fluidattacks.com/advisories/adams
https://github.com/advisories/GHSA-c942-mfmp-p4fh