medium6.1
CVE-2021-33041
Cross-site Scripting in vmd
Impact
vmd through 1.34.0 allows `div class="markdown-body"` XSS, as demonstrated by Electron remote code execution via `require('child_process').execSync('calc.exe')` on Windows and a similar attack on macOS.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | vmd | <= 1.34.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmd Project | Vmd | through 1.34.0 |