AIKIDO-2026-869349
md-editor-v3 is vulnerable to Cross-Site Scripting (XSS)
53
CVE Score
Medium
Cross-Site Scripting (XSS)
TL;DR
The first-party XSS plugin sanitizes raw HTML tokens but not math-token content in the Markdown renderer. On the initial render, before the default KaTeX script loads, the KaTeX plugin emits math content as raw HTML through an innerHTML fallback path. A math-delimited handler therefore bypasses the enabled XSS protection and runs in the host application's origin when a viewer opens the content. The fix escapes the math token content in the pre-KaTeX fallback so it renders as plain text.
How do I fix this?
Upgrade the md-editor-v3 library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable the shipped XSSPlugin to render untrusted Markdown that can contain math delimiters.
Package
Versions
4.11.3 - 6.5.5
Fixed in 6.5.6Background info
md-editor-v3 is vulnerable to Cross-Site Scripting (XSS) in versions 4.11.3 - 6.5.5.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.