GO-2026-4765 mo has a XSS via inline SVG script tags in Markdown rendering in github.com/k1LoW/mo

mo has a XSS via inline SVG script tags in Markdown rendering in github.com/k1LoW/mo...

mo has a XSS via inline SVG script tags in Markdown rendering

Summary When rendering Markdown files containing inline SVG elements with tags, the embedded JavaScript is executed in the browser. This is due to rehype-raw passing raw HTML including SVG through to the DOM without sanitization. PoC html alert1 Embedding the above in a Markdown file opened with ...