Md Editor V3
Monthly
Cross-site scripting in the MdPreview component of md-editor-v3 (versions up to and including 6.5.3) lets remote attackers execute JavaScript in the host application's origin by supplying Markdown that contains a crafted fenced-code language string, and because the host can persist that Markdown it escalates to stored XSS for every user who later views the content. User interaction is required - a victim must render the malicious Markdown - and the shipped XSSPlugin does not prevent exploitation, since it only filters existing html_block and html_inline tokens and cannot inspect the renderer-generated HTML that the highlight callback produces. Scored CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); publicly available exploit code exists (a working payload is included in the upstream GHSA advisory), no confirmed active exploitation (no CISA KEV listing), and the vendor-released patch fixes the issue in version 6.5.4.
Cross-site scripting in the MdPreview component of md-editor-v3 (versions up to and including 6.5.3) lets remote attackers execute JavaScript in the host application's origin by supplying Markdown that contains a crafted fenced-code language string, and because the host can persist that Markdown it escalates to stored XSS for every user who later views the content. User interaction is required - a victim must render the malicious Markdown - and the shipped XSSPlugin does not prevent exploitation, since it only filters existing html_block and html_inline tokens and cannot inspect the renderer-generated HTML that the highlight callback produces. Scored CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); publicly available exploit code exists (a working payload is included in the upstream GHSA advisory), no confirmed active exploitation (no CISA KEV listing), and the vendor-released patch fixes the issue in version 6.5.4.