Security readout for executives and security teams
Plain-English summary
StudyMD 0.3.2 is reported to store and run attacker-supplied JavaScript embedded in markdown files. If your organization uses this tool and processes untrusted markdown, users could be exposed to browser-based compromise. Public exploit and proof-of-concept references exist, but the provided sources do not show active exploitation in the wild.
Executive priority
Treat as a targeted remediation item if StudyMD is in use. The business risk is highest for teams handling outside markdown files. If StudyMD is not deployed, no immediate action is needed beyond confirming absence.
Technical view
CVE-2021-47842 is a persistent cross-site scripting issue in jotron StudyMD 0.3.2, mapped to CWE-79 with CVSS 7.2. The vulnerability involves malicious scripts embedded in markdown files that execute when the file is opened. The source bundle mentions potential remote code execution, but the core supported issue is stored XSS.
Likely exposure
Exposure is likely limited to environments running StudyMD 0.3.2, especially where users upload, share, or open markdown files from untrusted sources. Organizations not using StudyMD are not affected based on the provided data.
Exploitation context
Exploit-DB and a proof-of-concept video are cited, indicating public exploit knowledge. The CVE is not listed as KEV in the provided bundle, and no cited source confirms active exploitation.
Researcher notes
The bundle supports StudyMD 0.3.2 as affected and includes public exploit references. Patch status is not provided. The CVSS vector lists UI:N, while the description says execution occurs when a file is opened; treat that as an evidence inconsistency.
Mitigation direction
- Identify any use of StudyMD 0.3.2 in your environment.
- Avoid opening markdown files from untrusted or unknown sources.
- Restrict upload and sharing paths for StudyMD markdown content.
- Check the StudyMD repository or vendor guidance for updates or fixes.
- Consider replacing StudyMD if no maintained fixed version is available.
Validation and detection
- Confirm whether StudyMD is installed and record the exact version.
- Review workflows where users upload or open markdown files.
- Check repositories and shared folders for untrusted StudyMD markdown content.
- Review available vendor or project documentation for remediation status.
- Document compensating controls if continued use is required.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-47842 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N3.92.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-49832CVE reference · exploit
- StudyMD GitHub RepositoryCVE reference · product
- Proof of Concept VideoCVE reference · exploit
- VulnCheck Advisory: StudyMD 0.3.2 - Persistent Cross-Site ScriptingCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.