PatchTheCVECVE-2023-2971: Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access loca
CVE-2023-2971 is a medium-severity flaw (CVSS 6.3) affecting typora. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.
Why this priority
- Public exploit reference
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.3 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.5% (top 58%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2023-08-19 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-2971?
typora: upgrade to newer than 1.6.7. Exact commands for each OS are on this page.
Is CVE-2023-2971 being exploited?
CVE-2023-2971 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-2971 affect?
CVE-2023-2971 affects typora. Severity is medium (CVSS 6.3). Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user open
How urgent is CVE-2023-2971?
Priority 43/100. Public exploit reference; On your watchlist
Software pages
Related CVEs
- CVE-2024-41482 MEDIUM 6.1 UPGRADE Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component.
- CVE-2024-41481 MEDIUM 6.1 UPGRADE Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the Mermaid component.
- CVE-2024-33300 HIGH 7.3 UPGRADE Typora v1.0.0 through v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, whi
- CVE-2024-31784 MEDIUM 6.1 UPGRADE An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute ar
- CVE-2024-31783 MEDIUM 6.1 UPGRADE Cross Site Scripting (XSS) vulnerability in Typora v.1.6.7 and before, allows a local attacker to obtain sensi