CVE-2026-82805

MediumCVSS 4.3

Published: 31/08/2026(UTC)Updated: 31/08/2026(UTC)Translated: 31/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability was found in Typora up to 1.13.8/1.14.6 in the Mermaid Rendering Engine. Manipulating the classDef/style argument leads to XSS. The attack can be launched remotely and the exploit is public. The vendor released a fix in version 1.14.8.

Risk Assessment

A remote XSS attack could execute malicious scripts in the user's browser context, potentially leading to data theft or session hijacking.

Recommendation

Update Typora to version 1.14.8 or later immediately to remediate the vulnerability.

Other vulnerabilities in Typora

CVE-2022-40011Medium
An XSS vulnerability in Typora through version 1.3.8 allows an attacker to inject malicious JavaScript via a document containing an SVG element with an attacker-controlled onload attribute. When the exported document is opened by a victim, the code executes in the context of their browser.

Original NVD description (English source)

A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of the argument classDef/style results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 1.14.8 is able to resolve this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS