GHSA-mq6v-w35g-3c97

Dashboard / Vulnerabilities / GHSA-mq6v-w35g-3c97

GHSA-mq6v-w35g-3c97

Summary: Local File Inclusion vulnerability in zmarkdown

Details: ### Impact A minor Local File Inclusion vulnerability has been found in `zmarkdown`, which allowed for images with a known path on the host machine to be included inside a LaTeX document. To prevent it, a new option has been created that allow to replace invalid paths with a default image instead of linking the image on the host directly. `zmarkdown` has been updated to make this setting the default. Every user of `zmarkdown` is likely impacted, except if disabling LaTeX generation or images download. Here is an example of including an image from an invalid path: ```markdown  ``` Will effectively redownload and include the image found at `/tmp/img.png`. ### Patches The vulnerability has been patched in version 10.1.3. If impacted, you should update to this version as soon as possible. ### Workarounds Disable images downloading, or sanitize paths. ### For more information If you have any questions or comments about this advisory, open an issue in [ZMarkdown](https://github.com/zestedesavoir/zmarkdown/issues).

References: https://github.com/zestedesavoir/zmarkdown/security/advisories/GHSA-mq6v-w35g-3c97, https://github.com/zestedesavoir/zmarkdown