Threats Tagged 'ghsa-f8jw-52vm-m867'

Milkdown versions before 7.21.3 contain a stored cross-site scripting (XSS) vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages. This vulnerability allows attackers with document write access to inject arbitrary JavaScript that executes in the browser context of users who open the affected document or interact with rendered links. The issue arises because raw URL values from the remark AST are stored as href attributes without validating the URL scheme, and the DOMPurify.sanitize call fails to properly sanitize these URLs, allowing javascript: payloads to bypass filtering in link previews and anchor elements.