CVE-2026-84992: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in imzbf md-editor-v3
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping or consistently quoting it. Both highlighted and non-highlighted rendering paths reach this return value, while XSSPlugin filters only existing html_block and html_inline tokens before rendering and therefore cannot inspect the renderer-generated HTML. An attacker who can supply Markdown can use crafted fenced-code metadata to execute JavaScript in the application origin when a victim renders it, including as stored cross-site scripting when the host persists the Markdown. This issue is fixed in version 6.5.4
AI Analysis
Technical Summary
The vulnerability in md-editor-v3 arises from the MdPreview's useMarkdownIt() highlight callback, which inserts fenced-code language values into HTML class and language attributes without proper escaping or consistent quoting. The XSSPlugin only filters certain Markdown tokens before rendering and does not inspect the final renderer-generated HTML, allowing crafted fenced-code metadata to inject executable JavaScript. This can lead to stored cross-site scripting if the host persists the Markdown content. The vulnerability is addressed in version 6.5.4.
Potential Impact
An attacker able to supply Markdown content can execute arbitrary JavaScript in the application's origin when the Markdown is rendered by a victim. This can lead to partial confidentiality and integrity loss (as indicated by the CVSS vector), but does not affect availability. The vulnerability could be exploited as stored XSS if the Markdown is persisted by the host.
Mitigation Recommendations
Upgrade md-editor-v3 to version 6.5.4 or later, where this vulnerability is fixed. No other mitigations are specified or required according to the vendor advisory.
CVE-2026-84992: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in imzbf md-editor-v3
Description
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping or consistently quoting it. Both highlighted and non-highlighted rendering paths reach this return value, while XSSPlugin filters only existing html_block and html_inline tokens before rendering and therefore cannot inspect the renderer-generated HTML. An attacker who can supply Markdown can use crafted fenced-code metadata to execute JavaScript in the application origin when a victim renders it, including as stored cross-site scripting when the host persists the Markdown. This issue is fixed in version 6.5.4
CVSS v3.1
Score 6.1medium
Affected software
imzbf
md-editor-v3
pkg:github/imzbf/md-editor-v3Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in md-editor-v3 arises from the MdPreview's useMarkdownIt() highlight callback, which inserts fenced-code language values into HTML class and language attributes without proper escaping or consistent quoting. The XSSPlugin only filters certain Markdown tokens before rendering and does not inspect the final renderer-generated HTML, allowing crafted fenced-code metadata to inject executable JavaScript. This can lead to stored cross-site scripting if the host persists the Markdown content. The vulnerability is addressed in version 6.5.4.
Potential Impact
An attacker able to supply Markdown content can execute arbitrary JavaScript in the application's origin when the Markdown is rendered by a victim. This can lead to partial confidentiality and integrity loss (as indicated by the CVSS vector), but does not affect availability. The vulnerability could be exploited as stored XSS if the Markdown is persisted by the host.
Mitigation Recommendations
Upgrade md-editor-v3 to version 6.5.4 or later, where this vulnerability is fixed. No other mitigations are specified or required according to the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-02T18:12:13.534Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aad759f55bf5e2cf54f35d6
Added to database: 09/18/2026, 17:32:15 UTC
Last enriched: 09/18/2026, 17:46:58 UTC
Last updated: 09/18/2026, 18:17:55 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.