CVE-2026-57530

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

@abyss-project/commons-front-core (>=11.1.0, <=16.2.0), @codeck/crepe (>=0.0.6, <=0.0.11) +28 more potentially affected by CVE-2026-57530 via @milkdown/components (>=7.4.0, <=7.21.2)

@milkdown/components NPM version =7.4.0, =11.1.0, =0.0.6, =7.15.5, =7.5.2, =7.4.0, =7.6.0, =7.6.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.33.0, =0.35.0 and more Source cves: CVE-2026-57530 Source advisory: MEND:CVE-2026-57530...

CVE-2026-57530: Improper Neutralization of Input During Web Page Generation

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...