CVE-2022-25069: Marktext

Critical severity, CVSS 9.6. EPSS: 2% chance of exploitation in the next 30 days.

Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to perform remote code execution (RCE) via injecting a crafted payload into /lib/contentState/pasteCtrl.js.

Affected products

• Marktext Marktext: version 0.16.3 only

Published 2022-03-05. Last modified 2026-06-17.