CVE-2026-57530 Details
Description
Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a rendered link. The parseMarkdown runner stores raw URL values from the remark AST as href mark attributes without URL scheme validation, and the ineffective DOMPurify.sanitize call in edit-view.ts treats the bare URL string as a text node and returns it unchanged, allowing javascript: payloads to pass through the link-tooltip preview component and read-only mode anchor elements unmodified.
A stored cross-site scripting vulnerability has been identified in Milkdown versions prior to 7.21.3, specifically within the @milkdown/preset-commonmark and @milkdown/components packages. This vulnerability allows attackers with document write access to execute arbitrary JavaScript in the browser context of users who open the document or click on a rendered link. The issue arises because the parseMarkdown runner saves raw URL values from the remark AST as href mark attributes without validating the URL scheme. Additionally, the DOMPurify.sanitize call in edit-view.ts fails to properly sanitize bare URL strings, allowing javascript: payloads to bypass the link-tooltip preview component and read-only mode anchor elements unaltered.
Users can update to Milkdown version 7.21.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 24, 2026CISA-ADP
Assessed Jul 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Milkdown/milkdown/commit/db1ae721854a0ab2f188b83cf8695702966640f1 | [email protected] | Source CodeVendor |
| https://github.com/Milkdown/milkdown/pull/2410 | [email protected] | Issue TrackingVendor |
| https://github.com/Milkdown/milkdown/releases/tag/v7.21.3 | [email protected] | Release NotesVendor |
| https://www.npmjs.com/package/@milkdown/components | [email protected] | Permission RequiredProductVendor |
| https://www.npmjs.com/package/@milkdown/preset-commonmark | [email protected] | ProductVendor |
| https://www.vulncheck.com/advisories/milkdown-stored-xss-via-javascript-url-in-link-href | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Milkdown | < 7.21.3 (semver) |
CPE
Remediation
| |
| Milkdown Components | < 7.21.3 (semver) |
CPE
Remediation
| |
| Milkdown Preset Commonmark | < 7.21.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | New CVE Received | [email protected] |
| Jul 24, 2026 | CVE Modified | CISA-ADP |