# Exploit Title: Yank Note v3.52.1 (Electron) - Arbitrary Code Execution # Date: 2023-04-27 # Exploit Author: 8bitsec # CVE: CVE-2023-31874 # Vendor Homepage: yank-note.com # Software Link: https://github.com/purocean/yn # Version: 3.52.1 # Tested on: [Ubuntu 22.04 | Mac OS 13] Release Date: 2023-04-27 Product & Service Introduction: A Hackable Markdown Editor for Programmers. Version control, AI completion, mind map, documents encryption, code snippet running, integrated terminal, chart embedding, HTML applets, Reveal.js, plug-in, and macro replacement Technical Details & Description: A vulnerability was discovered on Yank Note v3.52.1 allowing a user to execute arbitrary code by opening a specially crafted file. Proof of Concept (PoC): Arbitrary code execution: Create a markdown file (.md) in any text editor and write the following payload. Mac: