CVE-2026-84992

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

NPM: md-editor-v3: XSS via fenced-code language rendering bypass

NPM: md-editor-v3: XSS via fenced-code language rendering bypass vulnerability discovered by ? in WordPress Npm md-editor-v3 versions = 6.5.3...

md-editor-v3: XSS via fenced-code language rendering bypass

Summary MdPreview interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped XSSPlugin is enabled. Details useMarkdownIt packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts:206 registers a...

GHSA-3RM2-H79C-8QW6 md-editor-v3: XSS via fenced-code language rendering bypass

Summary MdPreview interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped XSSPlugin is enabled. Details useMarkdownIt packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts:206 registers a...

CVE-2026-84992

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

CVE-2026-84992 md-editor-v3: XSS via fenced-code language rendering bypass

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

CVE-2026-84992

md-editor-v3 , a Markdown editor for Vue 3, contains an XSS vulnerability in MdPreview's useMarkdownIt() highlight callback (useMarkdownIt.ts:206). The fenced-code language value is interpolated into class="language-${language}" and an unquoted language=${language} HTML attribute without escaping...

CVE-2026-84992 md-editor-v3: XSS via fenced-code language rendering bypass

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

EUVD-2026-83198

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

CVE-2026-84992 md-editor-v3: XSS via fenced-code language rendering bypass

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

CVE-2026-84992: Improper Neutralization of Input During Web Page Generation

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...

PT-2026-95554

Name of the Vulnerable Software and Affected Versions md-editor-v3 versions prior to 6.5.4 Description MdPreview fails to escape or consistently quote the fenced-code language value when inserting it into class and language HTML attributes within the useMarkdownIt highlight callback. Because the...

github.com/gohugoio/hugo: Hugo: Stored Cross-Site Scripting via unescaped code-fence attribute values

A flaw was found in Hugo's default fenced-code-block renderer. This vulnerability allows a remote attacker to inject arbitrary script code into the rendered HTML by providing specially crafted input in the code-fence info string. Due to improper escaping of attribute values, a malicious quote can...

DEBIAN-CVE-2026-86430

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...

CVE-2026-86430

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...

CVE-2026-86430

league/commonmark (a PHP Markdown parsing library) versions before 2.9.1 are affected by multiple denial-of-service vulnerabilities in three components: fenced code block detection , reference link label lookup , and emphasis delimiter processing . The root cause is super-linear work performed on...

EUVD-2026-72388

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...

PT-2026-86796

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...

CVE-2026-86430: Inefficient Algorithmic Complexity

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...

SUSE CVE-2026-10618

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...