CVE-2021-47838: Markright 1.0 XSS Vulnerability

CVE-2021-47838 Overview

CVE-2021-47838 is a persistent cross-site scripting (XSS) vulnerability in Markright 1.0, an open-source markdown editor. Attackers can embed malicious JavaScript payloads inside crafted markdown files. When a victim opens the file in the Markright editor, the embedded script executes in the application context.

Because Markright is built on a desktop runtime that renders HTML, script execution can extend beyond the document context. The flaw is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation can lead to arbitrary JavaScript execution and, depending on the runtime, remote code execution on the victim's host.

Affected Products

Markright 1.0
Markright desktop markdown editor distributions built from the affected source
Downstream forks that inherit the unsanitized markdown rendering logic

Discovery Timeline

2026-01-16 - CVE-2021-47838 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2021-47838

Vulnerability Analysis

Markright 1.0 renders user-supplied markdown content without sanitizing embedded HTML or JavaScript constructs. When a user opens a crafted .md file, the application converts markdown to HTML and injects the result into a renderer that evaluates inline script content.

Because the payload is stored inside the markdown file itself, the issue is persistent rather than reflected. Any user who opens the file triggers execution. The vulnerability requires user interaction, but the attack surface is broad because markdown files are routinely shared through repositories, email, and chat platforms.

Root Cause

The root cause is missing output encoding and the absence of an allow-list HTML sanitizer in the markdown-to-HTML pipeline. The renderer trusts content authored in markdown and emits raw HTML elements, including <script> tags and event-handler attributes such as onerror and onload. See the VulnCheck Advisory on Markright for additional context.

Attack Vector

An attacker authors a markdown file containing inline HTML or script payloads and distributes it through standard channels. When the target opens the file in Markright 1.0, the renderer executes the payload with the privileges of the application process.

In desktop markdown editors built on web-based runtimes, script execution can reach Node.js APIs or local file system primitives if context isolation is not enforced. This is the path that enables the remote code execution outcome described in the public proof-of-concept on Exploit-DB #49834.

No verified code examples are reproduced here. See the GitHub Project Repository and the Exploit-DB entry for technical artifacts.

Detection Methods for CVE-2021-47838

Indicators of Compromise

Markdown files containing inline <script> tags, javascript: URIs, or HTML event handlers such as onerror, onload, or onclick
Markright process spawning unexpected child processes such as cmd.exe, powershell.exe, bash, or sh
Outbound network connections originating from the Markright process to untrusted hosts shortly after a markdown file is opened

Detection Strategies

Scan markdown repositories and shared file stores for HTML script constructs and suspicious event-handler attributes inside .md files
Apply endpoint behavioral rules that flag the Markright binary executing scripting interpreters or writing to autorun locations
Correlate file-open telemetry on .md files with subsequent process and network activity from the editor

Monitoring Recommendations

Log markdown file ingress from email gateways, collaboration platforms, and source-control pulls
Alert on Markright child processes that match known living-off-the-land binaries
Monitor user workstations for unsigned Markright builds and unauthorized version drift

How to Mitigate CVE-2021-47838

Immediate Actions Required

Remove or quarantine Markright 1.0 installations until a patched build is available
Block opening of untrusted markdown files received from external sources
Restrict execution of the Markright binary through application allow-listing on managed endpoints

Patch Information

No vendor-published patch is referenced in the available advisory data. Review the upstream GitHub Project Repository for the current maintenance status and any community fixes before redeploying. Until a fixed release is verified, treat Markright 1.0 as unpatched.

Workarounds

Replace Markright 1.0 with a markdown editor that disables raw HTML rendering or applies a strict sanitizer such as DOMPurify
Open untrusted markdown files in a text editor that does not render HTML, or in a sandboxed virtual machine
Strip inline HTML and script content from markdown files at the gateway using a markdown sanitizer before delivery to end users

bash

# Example: sanitize incoming markdown files by stripping HTML tags before user delivery
find /shared/markdown -name '*.md' -print0 | \
  xargs -0 -I{} sh -c 'sed -E "s/<[^>]+>//g" "{}" > "{}.clean" && mv "{}.clean" "{}"'