CVE-2026-84992

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

CVE-2026-84992 md-editor-v3: XSS via fenced-code language rendering bypass

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

CVE-2026-84992 md-editor-v3: XSS via fenced-code language rendering bypass

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

CVE-2026-84992 md-editor-v3: XSS via fenced-code language rendering bypass

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

CVE-2026-84992

md-editor-v3 , a Markdown editor for Vue 3, contains an XSS vulnerability in MdPreview's useMarkdownIt() highlight callback (useMarkdownIt.ts:206). The fenced-code language value is interpolated into class="language-${language}" and an unquoted language=${language} HTML attribute without escaping...

CVE-2026-84992: Improper Neutralization of Input During Web Page Generation

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

exp-labs

exp-labs Cybersecurity Training Platform This modern web secu...

nuxt-tawk-to (>=1.0.0, <=2.0.0) potentially affected by CVE-2025-8349 via @tawk.to/tawk-messenger-vue-3 (1.0.3)

@tawk.to/tawk-messenger-vue-3 NPM version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on @tawk.to/tawk-messenger-vue-3 and may be impacted: - nuxt-tawk-to =1.0.0, =2.0.0 Source cves: CVE-2025-8349 Source advisory:...

GHSA-G3CH-RX76-35FX vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)

A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code...