Known Vulnerabilities for products from Typora

Listed below are 18 of the newest known vulnerabilities associated with the vendor "Typora".

These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.

Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.

Known Vulnerabilities

CVE Shortened Description Severity Publish Date Last Modified
CVE-2023-39703 json A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbi... 6.1 - MEDIUM 2023-09-01 2023-09-07
CVE-2023-2971 json Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exf... 6.5 - MEDIUM 2023-08-19 2023-08-24
CVE-2023-2317 json DOM-based XSS in updater/update.html in Typora before 1.6.7 on Windows and Linux allows a crafted markdown file to run arbitr... 9.6 - CRITICAL 2023-08-19 2023-08-24
CVE-2023-2316 json Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltr... 7.4 - HIGH 2023-08-19 2023-08-24
CVE-2023-1003 json A vulnerability, which was classified as critical, was found in Typora up to 1.5.5 on Windows. Affected is an unknown functio... 7.8 - HIGH 2023-03-07 2023-11-07
CVE-2022-43668 json Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript code co... 6.1 - MEDIUM 2022-12-07 2022-12-12
CVE-2022-40011 json Typora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is expor... Not Provided 2022-12-23 2026-07-09
CVE-2020-21058 json ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... 6.1 - MEDIUM 2023-06-20 2023-06-27
CVE-2020-18748 json Cross Site Scripting (XSS) in Typora v0.9.65 allows attackers to execute arbitrary code via mathjax syntax due to a mathjax c... 6.1 - MEDIUM 2021-08-19 2021-08-23
CVE-2020-18737 json An issue was discovered in Typora 0.9.67. There is an XSS vulnerability that causes Remote Code Execution. 6.1 - MEDIUM 2021-02-05 2021-02-08
CVE-2020-18336 json ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... 7.4 - HIGH 2023-10-10 2023-10-11
CVE-2020-18221 json Cross Site Scripting (XSS) in Typora v0.9.65 and earlier allows remote attackers to execute arbitrary code by injecting comma... 6.1 - MEDIUM 2021-05-26 2021-05-28
CVE-2019-20374 json A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote... 9.6 - CRITICAL 2020-01-09 2021-09-08
CVE-2019-12172 json Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA ele... 7.8 - HIGH 2019-05-17 2020-08-24
CVE-2019-12137 json Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring i... 7.8 - HIGH 2019-05-16 2019-06-13
CVE-2019-7296 json typora through 0.9.64 has XSS, with resultant remote command execution, during inline rendering of a mathematical formula. 6.1 - MEDIUM 2019-01-31 2019-02-01
CVE-2019-7295 json typora through 0.9.63 has XSS, with resultant remote command execution, during block rendering of a mathematical formula. 6.1 - MEDIUM 2019-01-31 2019-02-01
CVE-2019-6803 json typora through 0.9.9.20.3 beta has XSS, with resultant remote command execution, via the left outline bar. 6.1 - MEDIUM 2019-01-25 2019-01-25

Known software with vulnerabilities from Typora

Type Vendor Product Version
ApplicationTyporaTypora0.8.1

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report