CVE-2026-57531

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

CVE-2026-57530

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

EUVD-2026-48736

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

CVE-2026-57531 Milkdown < 7.21.3 DOM XSS via innerHTML Assignment

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

CVE-2026-57531 Milkdown < 7.21.3 DOM XSS via innerHTML Assignment

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

CVE-2026-57531 Milkdown < 7.21.3 DOM XSS via innerHTML Assignment

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

@dolan-x/milkdown-core (>=0.0.21, <=0.0.46), @dolan-x/milkdown-plugins (>=0.0.26, <=0.0.46) +13 more potentially affected by CVE-2026-57531 via @milkdown/plugin-emoji (>=4.14.2, <=7.3.6)

@milkdown/plugin-emoji NPM version =4.14.2, =0.0.21, =0.0.26, =0.0.22, =0.0.1, =0.3.1, =0.0.2, =2.0.23, =0.0.26-beta-0.0.2, =1.0.0, =0.0.32, =1.0.27, =0.0.1, =0.0.52 Source cves: CVE-2026-57531 Source advisory: MEND:CVE-2026-57531...

CVE-2026-57531

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

CVE-2026-57531

Milkdown

CVE-2026-57531

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

EUVD-2026-48735

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

CVE-2026-57530

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

@abyss-project/commons-front-core (>=11.1.0, <=16.2.0), @codeck/crepe (>=0.0.6, <=0.0.11) +28 more potentially affected by CVE-2026-57530 via @milkdown/components (>=7.4.0, <=7.21.2)

@milkdown/components NPM version =7.4.0, =11.1.0, =0.0.6, =7.15.5, =7.5.2, =7.4.0, =7.6.0, =7.6.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.33.0, =0.35.0 and more Source cves: CVE-2026-57530 Source advisory: MEND:CVE-2026-57530...

CVE-2026-57530

Milkdown (versions

CVE-2026-57530

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

@abyss-project/commons-front-core (>=11.1.0, <=16.2.0), @codeck/components (>=0.0.1, <=0.0.5) +58 more potentially affected by CVE-2026-57530 via @milkdown/preset-commonmark (>=4.5.3, <=7.21.2)

@milkdown/preset-commonmark NPM version =4.5.3, =11.1.0, =0.0.1, =0.0.6, =0.0.1, =7.15.5, =0.0.24, =0.0.26, =0.0.22, =0.0.1, =0.3.1, =7.9.0, =7.5.2, =7.4.0, =5.3.2, =5.3.5 and more Source cves: CVE-2026-57530 Source advisory: MEND:CVE-2026-57530...

CVE-2026-57530 Milkdown < 7.21.3 Stored XSS via javascript: URL in link href

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

CVE-2026-57530 Milkdown < 7.21.3 Stored XSS via javascript: URL in link href

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

CVE-2026-57530 Milkdown < 7.21.3 Stored XSS via javascript: URL in link href

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

CVE-2026-57531: Improper Neutralization of Input During Web Page Generation

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...