CVE-2020-16608 – Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote

Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true).

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16608

Reference (s):

• https://github.com/notable/notable
• https://sghosh2402.medium.com/cve-2020-16608-8cdad9f4d9b4