https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-40276.htmlhttps://patchthecve.com/cve/CVE-2022-40276.htmlWed, 17 Jun 2026 05:01:13 +0000MEDIUM 5.5: Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Zettlr. This is possible because the application does not have a CSP policy (or at least not strict enough) and/or does not properly validathttps://patchthecve.com/cve/CVE-2021-26835.htmlhttps://patchthecve.com/cve/CVE-2021-26835.htmlWed, 17 Jun 2026 03:43:50 +0000MEDIUM 6.1: No filtering of cross-site scripting (XSS) payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform remote code execution via a crafted file.https://patchthecve.com/cve/CVE-2021-20727.htmlhttps://patchthecve.com/cve/CVE-2021-20727.htmlWed, 17 Jun 2026 03:34:19 +0000MEDIUM 6.1: Cross-site scripting vulnerability in Zettlr from 0.20.0 to 1.8.8 allows an attacker to execute an arbitrary script by loading a file or code snippet containing an invalid iframe into Zettlr.