Typora vulnerabilities
We track 5 vulnerabilities in Typora products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on December 12, 2025.
Latest Typora vulnerabilities
- 9.8 Critical severity
Typora: Improper Neutralization of Special Elements used in an OS Command
Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system commands. Attackers can inject malicious commands into the 'run command' input field during PDF export to achieve remote cod
- 7.3 High severity
typora: Improper Neutralization of Input During Web Page Generation
Typora v1.0.0 through v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, which allows attackers to execute arbitrary code by uploading Markdown files.
- 9.6 Critical severity
Typora: Improper Neutralization of Input During Web Page Generation
DOM-based XSS in updater/update.html in Typora before 1.6.7 on Windows and Linux allows a crafted markdown file to run arbitrary JavaScript code in the context of Typora main window via loading typora://app/typemark/updater/update.html in <embed> tag. This vul
- 7.4 High severity
Typora: Improper Limitation of a Pathname to a Restricted Directory
Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/<absolute-path>". This vulnerability can be exploited if a user opens a malicious mark
- 7.8 High severity
Typora: Improper Control of Generation of Code
A vulnerability, which was classified as critical, was found in Typora up to 1.5.5 on Windows. Affected is an unknown function of the component WSH JScript Handler. The manipulation leads to code injection. An attack has to be approached locally. The exploit h