CVE-2021-26835: Zettlr

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

No filtering of cross-site scripting (XSS) payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform remote code execution via a crafted file.

Affected products

• Zettlr Zettlr: version 1.8.7 only

Published 2021-06-18. Last modified 2026-06-17.