CVE-2018-6806

PoC —

CVSS 3.1

6.5 medium

EPSS

1%p66

Published

Feb 7, 2018 (Feb 7, 2018)

Modified

Jun 17, 2026

Description

Marked 2 through 2.5.11 allows remote attackers to read arbitrary files via a crafted HTML document that triggers a redirect to an x-marked://preview?text= URL. The value of the text parameter can include arbitrary JavaScript code, e.g., making XMLHttpRequest calls.

Vendors: marked 2 project
Products: marked 2
Weakness: CWE-200
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.