CVE-2023-44141: 
Homebrew vulnerability analysis and mitigation

Inkdrop prior to v5.6.0 contains a code injection vulnerability (CVE-2023-44141) that allows a local attacker to conduct a code injection attack by having a legitimate user open a specially crafted markdown file. The vulnerability was discovered and disclosed in October 2023 (JVN Advisory, NVD).

The vulnerability is classified as a code injection flaw (CWE-94) that affects the markdown processing functionality of Inkdrop. It has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack vector, low attack complexity, no privileges required, and user interaction required (JVN Advisory).

If successfully exploited, the vulnerability could allow an attacker to execute arbitrary code when a legitimate user opens a specially crafted markdown file. This could potentially lead to complete compromise of the affected system with the same privileges as the user running the application (JVN Advisory).

The vulnerability has been fixed in Inkdrop version 5.6.0. The application includes an auto-update feature that will automatically update affected versions to the patched version. Users are advised to ensure they are running version 5.6.0 or later (Inkdrop Forum).