PatchTheCVEzettlr vulnerabilities and fixes
Recent CVEs affecting zettlr, with upgrade or downgrade steps. 3 tracked.
zettlr has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2022-11-03. Highest priority: CVE-2021-26835 (score 44/100).
- CVE-2022-40276 MEDIUM 5.5 DOWNGRADE Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that a
- CVE-2021-26835 MEDIUM 6.1 DOWNGRADE No filtering of cross-site scripting (XSS) payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to
- CVE-2021-20727 MEDIUM 6.1 UPGRADE Cross-site scripting vulnerability in Zettlr from 0.20.0 to 1.8.8 allows an attacker to execute an arbitrary s
FAQ
How do I fix zettlr vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zettlr being exploited right now?
None of the tracked zettlr CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which zettlr CVE should I patch first?
CVE-2021-26835 currently ranks highest (44/100): No filtering of cross-site scripting (XSS) payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to.