16 matches found
CVE-2026-84992
creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:10+00:00| published-proof-of-concept| https://github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6 2026-09-19 11:31:49+00:00| seen| https://gist.github.com/alon710/bea1abe85bdbc7360f709e8ba11f8e2a...
CVE-2026-84992
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...
meadmin-addons-doc (>=1.0.0, <=1.3.14) potentially affected by CVE-2026-84992 via md-editor-v3 (6.3.1)
md-editor-v3 NPM version 6.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on md-editor-v3 and may be impacted: - meadmin-addons-doc =1.0.0, =1.3.14 Source cves: CVE-2026-84992 Source advisory: OSV:GHSA-3RM2-H79C-8QW6...
GHSA-3RM2-H79C-8QW6 md-editor-v3: XSS via fenced-code language rendering bypass
Summary MdPreview interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped XSSPlugin is enabled. Details useMarkdownIt packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts:206 registers a...
meadmin-addons-doc (>=1.0.0, <=1.3.14) potentially affected by CVE-2026-84992 via md-editor-v3 (6.3.1)
md-editor-v3 NPM version 6.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on md-editor-v3 and may be impacted: - meadmin-addons-doc =1.0.0, =1.3.14 Source cves: CVE-2026-84992 Source advisory: GHSA-3RM2-H79C-8QW6...
NPM: md-editor-v3: XSS via fenced-code language rendering bypass
NPM: md-editor-v3: XSS via fenced-code language rendering bypass vulnerability discovered by ? in WordPress Npm md-editor-v3 versions = 6.5.3...
md-editor-v3: XSS via fenced-code language rendering bypass
Summary MdPreview interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped XSSPlugin is enabled. Details useMarkdownIt packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts:206 registers a...
CVE-2026-84992 md-editor-v3: XSS via fenced-code language rendering bypass
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...
CVE-2026-84992 md-editor-v3: XSS via fenced-code language rendering bypass
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...
CVE-2026-84992
md-editor-v3 , a Markdown editor for Vue 3, contains an XSS vulnerability in MdPreview's useMarkdownIt() highlight callback (useMarkdownIt.ts:206). The fenced-code language value is interpolated into class="language-${language}" and an unquoted language=${language} HTML attribute without escaping...
CVE-2026-84992 md-editor-v3: XSS via fenced-code language rendering bypass
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...
CVE-2026-84992
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...
EUVD-2026-83198
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...
PT-2026-95554
Name of the Vulnerable Software and Affected Versions md-editor-v3 versions prior to 6.5.4 Description MdPreview fails to escape or consistently quote the fenced-code language value when inserting it into class and language HTML attributes within the useMarkdownIt highlight callback. Because the...
CVE-2026-84992: Improper Neutralization of Input During Web Page Generation
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...
CVE-2026-23525 1panel App Store vulnerable to Cross-site Scripting
1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting XSS vulnerability exists in the 1Panel App Store when viewing application details. Malicious scripts can execute in the context of the user’s browser, potentially compromising session data...