Most recent entries from all

EUVD-2026-372240

fkie_cve-2026-84992

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping or consistently quoting it. Both highlighted and non-highlighted rendering paths reach this return value, while XSSPlugin filters only existing html_block and html_inline tokens before rendering and therefore cannot inspect the renderer-generated HTML. An attacker who can supply Markdown can use crafted fenced-code metadata to execute JavaScript in the application origin when a victim renders it, including as stored cross-site scripting when the host persists the Markdown. This issue is fixed in version 6.5.4

GHSA-3rm2-h79c-8qw6 — md-editor-v3: XSS via fenced-code language rendering bypass

Affected: npm: md-editor-v3

### Summary `MdPreview` interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped `XSSPlugin` is enabled.

### Details `useMarkdownIt()` (`packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts:206`) registers a `highlight` callback whose final return inserts `language` into both `class="language-${language}"` and an unquoted `language=${language}` attribute without escaping. Both highlighting paths reach this return. `XSSPlugin()` filters only existing `html_block` and `html_inline` tokens before rendering, so it cannot inspect this renderer-generated HTML.

### PoC The Vue application enables the shipped `XSSPlugin` and renders attacker-controlled Markdown. `noHighlight: true` only makes reproduction deterministic; the default highlighting path reaches the same unsafe return. Use this as `src/main.js`:

```js import { createApp, h } from 'vue'; import { MdPreview, XSSPlugin, config } from 'md-editor-v3';

config({ markdownItPlugins: p => [...p, { type: 'xss', plugin: XSSPlugin, options: {} }] }); const markdown = '```x"><details/open/ontoggle=alert(document.domain)>\nSAFE\n```'; createApp({ render: () => h(MdPreview, { editorId: 'poc', modelValue: markdown, noHighlight: true }) }).mount('#app'); ```

Create and run the app, replacing `src/main.js` when indicated:

```sh npm create vite@latest poc -- --template vue cd poc npm install npm install md-editor-v3@6.5.3 # Repla…