CVE-2022-42967: Caret

Critical severity, CVSS 9.6. EPSS: 0.8% chance of exploitation in the next 30 days.

Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled. This directly leads to client-side code execution.

Affected products

• Caret Caret: any version

Published 2023-01-11. Last modified 2026-06-17.