CVE-2022-24123
📋 TL;DR
CVE-2022-24123 is a critical vulnerability in MarkText that allows remote code execution through malicious markdown files. Attackers can craft .md files containing XSS payloads in mermaid blocks that execute arbitrary code when rendered. All users of vulnerable MarkText versions are affected.
💻 Affected Systems
- MarkText
📦 What is this software?
Marktext by Marktext
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's machine through arbitrary code execution.
Likely Case
Data theft, malware installation, or ransomware deployment when users open malicious markdown files.
If Mitigated
Limited impact if users only open trusted files and have proper endpoint protection.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious .md file, but the payload execution is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.17.0 and later
Vendor Advisory: https://github.com/marktext/marktext/issues/2946
Restart Required: Yes
Instructions:
1. Download latest version from https://github.com/marktext/marktext/releases
2. Uninstall old version
3. Install new version
4. Restart system
🔧 Temporary Workarounds
Disable mermaid rendering
allTemporarily disable mermaid diagram rendering in MarkText settings
Use alternative markdown editor
allSwitch to a different markdown editor until patched
🧯 If You Can't Patch
- Only open markdown files from trusted sources
- Use sandboxed environment for opening untrusted markdown files
🔍 How to Verify
Check if Vulnerable:
Check MarkText version in Help > About menuCheck Version:
On Linux/macOS: marktext --version; On Windows: Check in Help > About menuVerify Fix Applied:
Verify version is 0.17.0 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from MarkText
- Network connections initiated by MarkText to suspicious domains
Network Indicators:
- MarkText making unexpected outbound connections
- Downloads of external resources during markdown rendering
SIEM Query:
process_name:"MarkText" AND (process_cmdline:*javascript* OR process_cmdline:*powershell* OR process_cmdline:*cmd*)