CVE-2026-57530

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

CVE-2026-57530

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

@abyss-project/commons-front-core (>=11.1.0, <=16.2.0), @codeck/components (>=0.0.1, <=0.0.5) +58 more potentially affected by CVE-2026-57530 via @milkdown/preset-commonmark (>=4.5.3, <=7.21.2)

@milkdown/preset-commonmark NPM version =4.5.3, =11.1.0, =0.0.1, =0.0.6, =0.0.1, =7.15.5, =0.0.24, =0.0.26, =0.0.22, =0.0.1, =0.3.1, =7.9.0, =7.5.2, =7.4.0, =5.3.2, =5.3.5 and more Source cves: CVE-2026-57530 Source advisory: MEND:CVE-2026-57530...

PT-2026-64409

Name of the Vulnerable Software and Affected Versions Milkdown versions prior to 7.21.3 Description A stored cross-site scripting issue exists in the @milkdown/preset-commonmark and @milkdown/components packages. Attackers with document write access can execute arbitrary JavaScript in the browser...

CVE-2026-57530: Improper Neutralization of Input During Web Page Generation

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...