A persistent cross-site scripting vulnerability in Marky 0.0.1 allows attackers to execute arbitrary code on the host system when a malicious markdown file is opened.

This is a persistent cross-site scripting (CWE-79) vulnerability occurring within the application's markdown editor. An attacker can craft a malicious markdown file containing JavaScript payloads that execute automatically upon the file being opened by a user, which can be leveraged to achieve remote code execution.

The ability for an attacker to execute arbitrary code on a user's machine creates a severe risk of system compromise, data theft, and unauthorized access to local environments. Given the CVSS score of 7.2, this vulnerability represents a high risk to organizational security, as it bypasses standard application boundaries and targets the underlying operating system of the user.

Immediate Action: As there is no official patch available for this version, users should immediately cease using the Marky 0.0.1 editor and remove the software from all systems until a secure version is released.

Proactive Monitoring: Security teams should monitor endpoint logs for suspicious child processes being spawned by the markdown editor or unauthorized outbound network connections initiated by the application.

Compensating Controls: Implement endpoint protection solutions that can detect and block malicious script execution patterns and restrict the ability of untrusted applications to execute system-level commands.

Public Exploit Available: Yes — a public proof-of-concept exists as detailed in the Exploit-DB entry 49831.

Due to the potential for remote code execution, this vulnerability poses a significant threat to any environment where Marky is deployed. Organizations must prioritize the removal of this software to eliminate the risk, as no vendor-provided patch exists to remediate the underlying flaw.