Milkdown
Monthly
DOM-based cross-site scripting in Milkdown's @milkdown/plugin-emoji before version 7.21.3 allows unauthenticated attackers to execute arbitrary JavaScript in the origin of applications embedding Milkdown when a victim pastes attacker-controlled content. The flaw stems from unsanitized innerHTML stored during HTML-to-markdown parsing and later assigned directly to a live DOM element, bypassing DOMPurify sanitization in the rendering path. No active exploitation or public exploit is known, and the EPSS score is low (0.25%).
Stored cross-site scripting in Milkdown before version 7.21.3 allows an attacker with document write access to inject JavaScript via malicious Markdown links. The parseMarkdown runner fails to validate URL schemes, and ineffective DOMPurify sanitization causes javascript: payloads to reach anchor elements in read‑only mode and link‑tooltip previews. When any user opens the document or interacts with the rendered link, arbitrary JavaScript executes in their browser.
DOM-based cross-site scripting in Milkdown's @milkdown/plugin-emoji before version 7.21.3 allows unauthenticated attackers to execute arbitrary JavaScript in the origin of applications embedding Milkdown when a victim pastes attacker-controlled content. The flaw stems from unsanitized innerHTML stored during HTML-to-markdown parsing and later assigned directly to a live DOM element, bypassing DOMPurify sanitization in the rendering path. No active exploitation or public exploit is known, and the EPSS score is low (0.25%).
Stored cross-site scripting in Milkdown before version 7.21.3 allows an attacker with document write access to inject JavaScript via malicious Markdown links. The parseMarkdown runner fails to validate URL schemes, and ineffective DOMPurify sanitization causes javascript: payloads to reach anchor elements in read‑only mode and link‑tooltip previews. When any user opens the document or interacts with the rendered link, arbitrary JavaScript executes in their browser.