{"id":"CVE-2021-33041","details":"vmd through 1.34.0 allows 'div class=\"markdown-body\"' XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe') on Windows and a similar attack on macOS.","aliases":["GHSA-pfr3-87q3-65rc"],"modified":"2026-07-09T06:35:19.369392Z","published":"2021-05-17T17:15:08.730Z","references":[{"type":"REPORT","url":"https://github.com/yoshuawuyts/vmd/issues/137"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yoshuawuyts/vmd","events":[{"introduced":"0"},{"last_affected":"4a16c6f2909022f0c83ae5038ec9b60f5aaa7f03"}],"database_specific":{"cpe":"cpe:2.3:a:vmd_project:vmd:*:*:*:*:*:node.js:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"1.34.0"}],"source":"CPE_RANGE"}}],"versions":["1.34.0","1.33.1","1.33.0","1.32.0","1.31.2","1.31.1","1.31.0","1.30.0","1.29.2","1.29.1","1.29.0","1.28.0","1.27.0","1.26.4","1.26.3","1.26.2","1.26.1","1.26.0","1.25.1","1.25.0","1.24.1","1.24.0","1.23.0","1.22.1","1.22.0","1.21.3","1.21.2","1.21.1","1.21.0","1.20.2","1.20.1","1.20.0","1.19.0","1.18.1","1.18.0","1.17.0","1.16.0","v1.15.1","1.15.0","1.14.0","1.13.0","1.12.0","1.11.0","1.10.0","1.9.0","1.8.1","1.8.0","1.7.4","1.7.3","1.7.2","v1.7.1","v1.7.0","v1.5.0","v1.4.3","v1.4.2","v1.4.1","1.4.0","1.3.0","1.2.0","1.1.2","1.1.1","1.1.0","v1.0.5","1.0.5","v1.0.4","1.0.4","v1.0.3","1.0.3","v1.0.2","1.0.2","v1.0.1","1.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33041.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}