Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

md-editor-v3

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.1npmAmendedPublished

    md-editor-v3: XSS via fenced-code language rendering bypass

    CVE-2026-84992 · GHSA-3rm2-h79c-8qw6

    Affected
    • npm md-editor-v3 <= 6.5.3
    Fixed in
    6.5.4· Vendor fix available
    Issue
    MdPreview interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped XSSPlugin is enabled. Details useMarkdownIt() (packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts:206) registers a highlight callback whose final return inserts language into both class="language-${language}" and an unquoted language=${language} attribute without escaping. Both highlighting paths reach this return. XSSPlugin() filters only existing htmlblock and htmlinline tokens before rendering, so it cannot inspect this renderer-generated HTML. PoC The Vue application enables the shipped XSSPlugin and renders attacker-controlled Markdown. noHighlight: true only makes reproduction deterministic; the default highlighting path reaches the same unsafe return. Use this as src/main.js: x"<details/open/ontoggle=alert(document.domain)\nSAFE\n Create and run the app, replacing src/main.js when indicated:…

    Recommended action: Upgrade to 6.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →