CVE-2022-40011: Typora

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Typora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is exported and then used at a victim's origin.

Affected products

• Typora Typora: up to and including 1.3.8

Published 2022-12-23. Last modified 2026-07-09.