AIKIDO-2026-963238

md-editor-v3 is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)GHSA-3rm2-h79c-8qw6 Published 2 days ago

Medium Risk

This Affects:

md-editor-v3

0.0.1 - 6.5.3

Fixed in 6.5.4

Are you affected? Scan for Free

TL;DR

The Markdown preview renderer in MdPreview interpolates a fenced code block's language info string into HTML attributes without escaping it. A crafted info string on a code fence breaks out of the attribute and injects arbitrary markup, so JavaScript executes in the page origin when the preview is rendered. The bundled XSSPlugin does not stop this because it only inspects pre-existing HTML tokens and never sees the markup produced by the highlight callback, so hosted Markdown becomes stored cross-site scripting. The fix escapes the language value with escapeHtml and quotes the attribute before interpolation.

Who does this affect?

You are affected if your application uses MdPreview (or the MdEditor preview) to render Markdown that comes from untrusted or externally influenced sources on any release up to and including 6.5.3. Enabling the bundled XSSPlugin does not protect you, because the malicious markup is emitted by the fenced-code highlight renderer and never passes through the sanitized HTML tokens the plugin inspects. Applications that only render fully trusted, first-party Markdown are not at practical risk.