earmark CVE-2026-48591

Q: What is the CVSS score of CVE-2026-48591?

CVE-2026-48591 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Script in Attributes in a Web Page (CWE-83)

2026-06-17 EEF

XSS Earmark

4.8

CVSS 4.0 · Vendor: EEF

Severity by source

Vendor (EEF) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network delivery of stored XSS; PR:L reflects that most applications require an account to submit stored content; victim page-load triggers execution with scope change into browser context.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (EEF).

CVSS VectorVendor: EEF

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 18:09 vuln.today

DescriptionCVE.org

Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.

'Elixir.Earmark.Transform':_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: [" ", name, "=\"", value, "\""]. Text nodes are routed through the existing escape function which encodes " as ", but attribute values never visit that path. A markdown link whose URL or title contains a bare " closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, click) renders as <a href="http://example.com/?a=x" onerror="alert(1)">click</a>, executing arbitrary JavaScript in the victim's browser.

The earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.

This issue affects earmark from 1.4.1 onward.

AnalysisAI

Stored cross-site scripting in earmark (the Elixir Markdown-to-HTML library by pragdave) allows any attacker who can submit markdown content to inject arbitrary JavaScript that executes in the browsers of users who view the rendered output. The root cause is a code path in _make_att1/2 (lib/earmark/transform.ex) that splices HTML attribute values verbatim without encoding double-quote characters, enabling a crafted link URL or title to break out of the href attribute and inject additional HTML event handlers. Critically, no patched version will be released - the library has been officially retired from Hex - making migration to a maintained alternative the only complete fix. No public exploit identified at time of analysis, though the CVE description itself contains a working proof-of-concept payload.

Technical ContextAI

CWE-83 (Improper Neutralization of Script in Attributes in a Web Page) describes the root cause precisely: HTML attribute values must be encoded before insertion into quoted attribute contexts, and earmark's _make_att1/2 function in lib/earmark/transform.ex fails to do this. The function constructs attribute strings by concatenating [" ", name, "=\"", value, "\""] - wrapping the value in literal double-quote bytes without escaping any double-quotes within value itself. Earmark does have an escape function that converts " to " for text nodes, but attribute values never pass through it. The resulting HTML allows a bare double-quote inside a link URL or title to terminate the href attribute early; the browser then parses remaining bytes as sibling attributes, enabling injection of event handlers such as onerror, onmouseover, or onclick. CPE cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:* with no version bound confirms every release from 1.4.1 onward is vulnerable, with no fixed upper bound since the library is abandoned.

RemediationAI

No vendor-released patch will be issued; earmark is officially retired and the maintainer has confirmed no fix will be released. The primary and complete remediation is to migrate to a maintained Elixir Markdown library - the CVE advisory specifically recommends MDEx, which provides Elixir bindings for the actively maintained comrak (CommonMark) renderer with proper attribute escaping. As a compensating control for applications that cannot immediately migrate, post-process all earmark HTML output through a dedicated HTML sanitization library such as html_sanitize_ex configured to strip event handler attributes (onerror, onmouseover, onclick, etc.) before serving output to users; be aware this adds processing overhead and may affect rendering of intentional inline HTML. A second interim control is to pre-validate or strip bare double-quote characters from link URLs and titles in markdown input before passing to earmark, though this approach is fragile, does not cover all attribute contexts, and should not be treated as a permanent fix. See https://cna.erlef.org/cves/CVE-2026-48591.html for the authoritative advisory confirming the retirement status and migration guidance.