The vulnerability in Milkdown before version 7.21.3 is a stored cross-site scripting issue affecting the @milkdown/preset-commonmark and @milkdown/components packages. It occurs because the parseMarkdown runner stores raw URL values from the remark AST as href mark attributes without validating the URL scheme. Additionally, the DOMPurify.sanitize function used in edit-view.ts does not effectively sanitize these URLs, treating them as text nodes and allowing malicious javascript: URLs to pass through unmodified. This enables attackers with write access to documents to execute arbitrary JavaScript in the browser context of users who view or interact with the document, leading to potential XSS attacks.

An attacker with the ability to write to a document can inject malicious JavaScript code that executes in the browsers of users who open the document or click on rendered links. This can lead to cross-site scripting attacks, potentially compromising user sessions, stealing sensitive information, or performing actions on behalf of the user within the affected application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to Milkdown version 7.21.3 or later once available. Until then, restrict document write access to trusted users only to reduce the risk of exploitation.