CVE-2019-12172

7.8 highEPSS 1.8%

High (7.8) in typora typora. EPSS 1.8% chance of exploitation in the next 30 days.

Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137.

Severity

CVSS 3.0

7.8 high

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2019-05-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

typora:typora

References

https://github.com/typora/typora-issues/issues/2166
https://github.com/typora/typora-issues/issues/2166

Check your stack JSON