Arbitrary file disclosure via malicious Markdown rendering

Information disclosure in Zettlr 2.3.0 allows remote attackers to read arbitrary local files when a client views a malicious Markdown file. The renderer accepts attacker-controlled Markdown without an effective Content Security Policy or sufficient content validation, permitting file access during preview. Exploitation requires the victim to open the crafted document; the reported impact is confidentiality loss without integrity or availability effects.