CVE-2021-47836: Markdown Explorer XSS Vulnerability

CVE-2021-47836 Overview

CVE-2021-47836 is a persistent cross-site scripting (XSS) vulnerability in Markdown Explorer 0.1.1, an Electron-based markdown viewer and editor. The application fails to sanitize markdown content rendered through its editor and file preview features. Attackers can craft markdown files containing embedded JavaScript payloads that execute when a victim opens or previews the file. Because Markdown Explorer is built on Electron, script execution can extend beyond the browser context and reach Node.js APIs, enabling local command execution on the host. The flaw is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact

Attackers can deliver weaponized .md files that execute arbitrary JavaScript and, in Electron contexts, run host commands when victims open the file.

Affected Products

• Markdown Explorer 0.1.1
• Earlier versions sharing the same rendering pipeline
• Electron builds distributed from the upstream repository

Discovery Timeline

• 2026-01-16 - CVE-2021-47836 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2021-47836

Vulnerability Analysis

Markdown Explorer renders user-supplied markdown without enforcing output encoding or a restrictive content security policy. Markdown specifications permit inline HTML, and the application passes that HTML directly into the rendered DOM. An attacker can embed <script> tags, event handler attributes, or javascript: URIs in a markdown document. When the victim opens or previews the file, the payload executes in the application's renderer process.

The vulnerability is persistent because the payload lives inside a stored file. Sharing the file through email, chat, or a repository preserves the injection across sessions and machines. Public exploit material is available on Exploit-DB entry 49826 and the VulnCheck advisory.

Root Cause

The root cause is missing output sanitization in the markdown-to-HTML rendering path. The application trusts inline HTML and does not strip or escape <script>, event handlers such as onerror and onload, or unsafe URI schemes. No content security policy restricts inline script execution in the renderer.

Attack Vector

Exploitation requires user interaction. An attacker delivers a malicious .md file through download, repository clone, or attachment. When the victim opens the file in Markdown Explorer, embedded JavaScript runs in the renderer. In Electron applications without context isolation, the payload can invoke Node.js APIs such as child_process.exec to execute operating system commands. See the project repository and the proof-of-concept screenshots for the exploitation chain.

Detection Methods for CVE-2021-47836

Indicators of Compromise

• Markdown files containing <script>, <img onerror=...>, or <iframe src="javascript:..."> constructs
• Unexpected child processes spawned by the Markdown Explorer binary, particularly cmd.exe, powershell.exe, sh, or bash
• Outbound network connections from the Markdown Explorer process to unfamiliar hosts shortly after a file is opened
• .md files arriving from untrusted email, chat, or repository sources

Detection Strategies

• Scan markdown files at rest and in transit for inline HTML script tags and JavaScript URI schemes
• Monitor process lineage for shell or scripting interpreters launched by the Markdown Explorer executable
• Alert on file writes to startup, scheduled task, or autostart locations performed by the editor process
• Inspect endpoint telemetry for renderer processes invoking Node.js child process APIs

Monitoring Recommendations

• Forward endpoint process and file telemetry to a centralized analytics platform with retention sufficient for retrospective hunts
• Build hunting queries that correlate markdown file opens with subsequent process creation events
• Track distribution channels (mail gateways, code hosting) for markdown attachments containing executable HTML

How to Mitigate CVE-2021-47836

Immediate Actions Required

• Stop opening untrusted markdown files in Markdown Explorer 0.1.1 until a patched build is verified
• Remove or quarantine the application from production endpoints handling sensitive data
• Treat shared .md files from external senders as untrusted attachments and inspect them in a sandbox
• Replace Markdown Explorer with a maintained markdown viewer that enforces sanitization and Electron context isolation

Patch Information

No vendor patch is identified in the published advisory data. Monitor the upstream GitHub repository for fix commits and the VulnCheck advisory for remediation updates. If maintaining a fork, integrate a sanitizer such as DOMPurify in the render pipeline and enable Electron contextIsolation with nodeIntegration disabled.

Workarounds

• Render markdown only after stripping inline HTML via a server- or client-side sanitizer
• Disable Node.js integration in the Electron renderer and enable context isolation
• Apply a strict content security policy that blocks inline scripts and javascript: URIs
• Open untrusted markdown files in a non-Electron viewer such as a plain text editor

# Configuration example: enforce safer Electron defaults in a maintained fork
# main.js excerpt
const win = new BrowserWindow({
  webPreferences: {
    nodeIntegration: false,
    contextIsolation: true,
    sandbox: true
  }
});
win.webContents.session.webRequest.onHeadersReceived((details, cb) => {
  cb({ responseHeaders: {
    ...details.responseHeaders,
    'Content-Security-Policy': ["default-src 'self'; script-src 'self'"]
  }});
});