{"id":"CVE-2022-25069","details":"Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to perform remote code execution (RCE) via injecting a crafted payload into /lib/contentState/pasteCtrl.js.","modified":"2026-08-12T03:51:19.645380773Z","published":"2022-03-05T00:29:01Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25069.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25069.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25069"},{"type":"REPORT","url":"https://github.com/marktext/marktext/issues/2990"},{"type":"FIX","url":"https://github.com/marktext/marktext/pull/3002"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/marktext/marktext","events":[{"introduced":"cb38f99d2dbe8e828de390ad3a0c7263a59c3cb8"},{"last_affected":"cb38f99d2dbe8e828de390ad3a0c7263a59c3cb8"}],"database_specific":{"source":"CPE_STRING","cpe":"cpe:2.3:a:marktext:marktext:0.16.3:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.16.3"},{"last_affected":"0.16.3"}]}}],"versions":["0.16.3","v0.16.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25069.json"}}],"schema_version":"1.9.0"}