CVE-2019-12043 describes a Cross-Site Scripting (XSS) vulnerability in remarkable 1.7.1, specifically within the lib/parser_inline.js component, due to improper URL filtering that allows unprintable characters to bypass security. This medium-severity vulnerability (CVSS 6.1) has a low attack complexity and requires user interaction, potentially leading to limited confidentiality and integrity impacts. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in the KEV catalog, though it has received some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.7.1CPE matchmatch criteria | cpe:2.3:a:remarkable_project:remarkable:1.7.1:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.