{"id":"GHSA-3rm2-h79c-8qw6","summary":"md-editor-v3: XSS via fenced-code language rendering bypass","details":"### Summary\n`MdPreview` interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped `XSSPlugin` is enabled.\n\n### Details\n`useMarkdownIt()` (`packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts:206`) registers a `highlight` callback whose final return inserts `language` into both `class=\"language-${language}\"` and an unquoted `language=${language}` attribute without escaping. Both highlighting paths reach this return. `XSSPlugin()` filters only existing `html_block` and `html_inline` tokens before rendering, so it cannot inspect this renderer-generated HTML.\n\n### PoC\nThe Vue application enables the shipped `XSSPlugin` and renders attacker-controlled Markdown. `noHighlight: true` only makes reproduction deterministic; the default highlighting path reaches the same unsafe return. Use this as `src/main.js`:\n\n```js\nimport { createApp, h } from 'vue';\nimport { MdPreview, XSSPlugin, config } from 'md-editor-v3';\n\nconfig({ markdownItPlugins: p =\u003e [...p, { type: 'xss', plugin: XSSPlugin, options: {} }] });\nconst markdown = '```x\"\u003e\u003cdetails/open/ontoggle=alert(document.domain)\u003e\\nSAFE\\n```';\ncreateApp({ render: () =\u003e h(MdPreview,\n  { editorId: 'poc', modelValue: markdown, noHighlight: true })\n}).mount('#app');\n```\n\nCreate and run the app, replacing `src/main.js` when indicated:\n\n```sh\nnpm create vite@latest poc -- --template vue\ncd poc\nnpm install\nnpm install md-editor-v3@6.5.3\n# Replace src/main.js with the code above.\nnpm run dev\n```\n\nOpening the displayed URL automatically shows the application hostname in an alert.\n\n### Impact\nAn attacker who can supply Markdown can execute JavaScript in the application origin when a victim renders it. If the host stores that Markdown, this becomes stored XSS.\n\n### Suggested fix\nEscape `language` with `md.utils.escapeHtml` before interpolation and quote the `language` attribute. Add this payload and the raw control as regression tests with `XSSPlugin` enabled.","aliases":["CVE-2026-84992"],"modified":"2026-09-18T17:30:08.398856654Z","published":"2026-09-18T17:17:36Z","database_specific":{"github_reviewed_at":"2026-09-18T17:17:36Z","nvd_published_at":null,"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6"},{"type":"WEB","url":"https://github.com/imzbf/md-editor-v3/commit/2c07360420e74087f5bc63032ab155d93e0a0b10"},{"type":"PACKAGE","url":"https://github.com/imzbf/md-editor-v3"},{"type":"WEB","url":"https://github.com/imzbf/md-editor-v3/releases/tag/v6.5.4"}],"affected":[{"package":{"name":"md-editor-v3","ecosystem":"npm","purl":"pkg:npm/md-editor-v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.5.4"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 6.5.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-3rm2-h79c-8qw6/GHSA-3rm2-h79c-8qw6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}