Codimd (Hackmd) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 44 known versions, newest CVE from 2025-04-26. Vendor: Hackmd.

CVEs of Codimd

• CVE-2025-46655 - CVSS 4.9 (medium), 2025-04-26: CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain…
• CVE-2025-46654 - CVSS 4.9 (medium), 2025-04-26: CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file…
• CVE-2024-38354 - CVSS 8.1 (high), 2024-07-10: CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe `HTML` tags with an…
• CVE-2024-38353 - CVSS 5.3 (medium), 2024-07-10: CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing…
• CVE-2024-22778 - CVSS 7.5 (high), 2024-02-21: HackMD CodiMD <2.5.2 is vulnerable to Denial of Service.
• CVE-2019-15499 - CVSS 6.1 (medium), 2019-08-23: CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL.