https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-41482.htmlhttps://patchthecve.com/cve/CVE-2024-41482.htmlWed, 17 Jun 2026 07:47:47 +0000MEDIUM 6.1: Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component.https://patchthecve.com/cve/CVE-2024-41481.htmlhttps://patchthecve.com/cve/CVE-2024-41481.htmlWed, 17 Jun 2026 07:47:47 +0000MEDIUM 6.1: Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the Mermaid component.https://patchthecve.com/cve/CVE-2024-33300.htmlhttps://patchthecve.com/cve/CVE-2024-33300.htmlWed, 17 Jun 2026 07:31:38 +0000HIGH 7.3: Typora v1.0.0 through v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, which allows attackers to execute arbitrary code by uploading Markdown files.https://patchthecve.com/cve/CVE-2024-31784.htmlhttps://patchthecve.com/cve/CVE-2024-31784.htmlWed, 17 Jun 2026 07:28:43 +0000MEDIUM 6.1: An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the src component.https://patchthecve.com/cve/CVE-2024-31783.htmlhttps://patchthecve.com/cve/CVE-2024-31783.htmlWed, 17 Jun 2026 07:28:43 +0000MEDIUM 6.1: Cross Site Scripting (XSS) vulnerability in Typora v.1.6.7 and before, allows a local attacker to obtain sensitive information via a crafted script during markdown file creation.https://patchthecve.com/cve/CVE-2020-18336.htmlhttps://patchthecve.com/cve/CVE-2020-18336.htmlWed, 17 Jun 2026 02:59:17 +0000HIGH 7.4: Cross Site Scripting (XSS) vulnerability found in Typora v.0.9.65 allows a remote attacker to obtain sensitive information via the PDF file exporting function.https://patchthecve.com/cve/CVE-2023-39703.htmlhttps://patchthecve.com/cve/CVE-2023-39703.htmlWed, 17 Jun 2026 06:12:45 +0000MEDIUM 6.1: A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbitrary code via uploading a crafted Markdown file.https://patchthecve.com/cve/CVE-2023-2971.htmlhttps://patchthecve.com/cve/CVE-2023-2971.htmlWed, 17 Jun 2026 05:53:54 +0000MEDIUM 6.3: Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from ahttps://patchthecve.com/cve/CVE-2023-2317.htmlhttps://patchthecve.com/cve/CVE-2023-2317.htmlWed, 17 Jun 2026 05:52:16 +0000HIGH 8.6: DOM-based XSS in updater/update.html in Typora before 1.6.7 on Windows and Linux allows a crafted markdown file to run arbitrary JavaScript code in the context of Typora main window via loading typora://app/typemark/updater/update.html in <embed> tag. This vulnerability can be exploited if a user ophttps://patchthecve.com/cve/CVE-2023-2316.htmlhttps://patchthecve.com/cve/CVE-2023-2316.htmlWed, 17 Jun 2026 05:52:16 +0000HIGH 7.4: Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text frhttps://patchthecve.com/cve/CVE-2020-21058.htmlhttps://patchthecve.com/cve/CVE-2020-21058.htmlWed, 17 Jun 2026 03:03:32 +0000MEDIUM 6.1: Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax.