A persistent cross-site scripting vulnerability in Markright 1.0 allows attackers to execute arbitrary JavaScript and potentially gain remote code execution on the underlying system.

The application fails to properly sanitize input within markdown files, leading to a persistent cross-site scripting (CWE-79) vulnerability. An authenticated attacker can upload a specially crafted markdown file that executes malicious payloads in the context of the user or system, potentially facilitating remote code execution.

Successful exploitation of this vulnerability poses a severe risk to organizational security, as it allows for arbitrary code execution on systems running the vulnerable software. This could lead to full system compromise, unauthorized access to sensitive data, and potential lateral movement within the network. Given the CVSS score of 7.2, this vulnerability represents a high-risk entry point that should be prioritized for remediation.

Immediate Action: As no official patch is currently available, administrators should restrict the ability to upload or load markdown files from untrusted sources.

Proactive Monitoring: Review application logs for unusual file upload activities or unexpected JavaScript execution patterns within the editor environment.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block malicious markdown content or scripts before they reach the application.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the Exploit-DB entry 49834.

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a significant threat. Organizations currently using Markright 1.0 must treat this as a high-priority issue. Until a vendor-supplied update or patch is released, strict access controls and rigorous input validation are necessary to mitigate the risk of exploitation.