Description

A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of the argument classDef/style results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 1.14.8 is able to resolve this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-31T16:19:19.687Z",
  "pubdate": "2026-08-31T16:19:19.687Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the Mermaid Rendering Engine component of Typora.\nThe vulnerability allows remote attackers to inject malicious scripts into the application by manipulating specific arguments during the rendering process.\nAffected versions include Typora up to 1.13.8 and 1.14.6.\nThe vulnerability arises from improper sanitization of user-supplied data handled by the Mermaid diagramming engine, leading to arbitrary JavaScript execution within the context of the user's Typora session.\nSuccessful exploitation poses a significant risk to user confidentiality and integrity, as attackers could perform unauthorized actions, steal sensitive data, or interact with the local filesystem if the application's security context permits.\nThe vulnerability is currently public, increasing the likelihood of exploitation attempts against unpatched systems.\nUsers are strongly advised to update to version 1.14.8 to remediate the security defect.",
  "technicalDetails": "The vulnerability is located within the Mermaid Rendering Engine of Typora, which is responsible for parsing and displaying diagrammatic content defined in Markdown files.\nThe root cause is an insufficient validation and sanitization mechanism for inputs processed by the classDef or style directives within Mermaid diagrams.\nWhen a malicious actor crafts a Mermaid diagram containing a payload within these specific arguments, the rendering engine fails to adequately escape or neutralize the injected HTML/JavaScript sequences.\nThe attack flow initiates when the victim opens or previews a Markdown document containing the malicious Mermaid syntax. Upon the rendering process, the application interprets the malicious input as legitimate functional code rather than static data.\nBecause the rendering engine executes in an environment that may have access to document object model (DOM) properties, the injected script is executed within the application's privilege context.\nThis behavior facilitates Cross-Site Scripting (XSS), where the attacker's script can interact with the underlying browser-based UI components used by Typora.\nSince the attack is triggered upon the rendering of the malicious diagram, it can be launched remotely if an attacker transmits the document to the victim (e.g., via email, shared documents, or web downloads).\nNo authentication or specific privilege level is required for the attacker to initiate the exploitation beyond the victim interacting with the malicious file.\nPost-exploitation impact includes the potential for session hijacking, local information disclosure, or the execution of unauthorized commands if the application environment allows access to node-integrated features or local APIs.\nThe vulnerability persists across all Typora versions up to 1.13.8 and 1.14.6. The flaw specifically targets the parsing logic where style attributes and class definitions are transformed into rendered elements. By bypassing standard input filtering, the attacker forces the renderer to process dangerous tags or attribute payloads, which are then rendered into the application's document interface, resulting in immediate script execution."
}