Open a private security advisory through GitHub's Security → Report a vulnerability on this repository. Please do not open a public issue for anything exploitable.

Include what you did, what happened, and what you expected. A document that reproduces the problem is worth more than a description of it.

This is a desktop application with no network service and no remote input, so the interesting surface is narrow and specific:

• HTML export. Documents may contain arbitrary raw HTML, and an exported file is opened in a browser. Export runs through an allowlist sanitiser (MarkdownStudio.Rendering.Html) by default. A payload that survives sanitisation is a vulnerability.
• Paste. Clipboard HTML is converted to Markdown rather than inserted, and images are written to disk. A paste that escapes the document directory, or that writes somewhere it should not, is a vulnerability.
• File handling. Opening a malformed or hostile file should fail cleanly. A crash is a bug; a crash that writes outside the target path is a vulnerability.
• The Windows installer. It verifies its embedded payload against a SHA-256 manifest before extracting. A path that skips or subverts that check is a vulnerability.

Turning the sanitiser off is a documented option, and unsanitised export is then working as specified. Rendering a document that says alarming things is not a vulnerability. Neither is a link in a document opening in the system browser — that is the feature.

The most recent release. This project does not maintain release branches.