Threats Tagged 'ghsa-7jff-jg2j-4x95'

Milkdown versions before 7.21.3 contain a DOM-based cross-site scripting (XSS) vulnerability in the @milkdown/plugin-emoji package. This vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of the host application by tricking a victim into pasting attacker-controlled content. The issue arises because the plugin's parseDOM.getAttrs handler stores raw innerHTML from pasted span elements with data-type="emoji" without sanitization. Later, the toMarkdown runner assigns this unsanitized content directly to a live DOM element's innerHTML, bypassing the DOMPurify sanitization used elsewhere, resulting in script execution during markdown serialization cycles.