CVE-2026-84992 Details
Description
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping or consistently quoting it. Both highlighted and non-highlighted rendering paths reach this return value, while XSSPlugin filters only existing html_block and html_inline tokens before rendering and therefore cannot inspect the renderer-generated HTML. An attacker who can supply Markdown can use crafted fenced-code metadata to execute JavaScript in the application origin when a victim renders it, including as stored cross-site scripting when the host persists the Markdown. This issue is fixed in version 6.5.4
A cross-site scripting (XSS) vulnerability has been identified in md-editor-v3, a Markdown editor for Vue 3. This issue affects versions through 6.5.3. The vulnerability arises in the useMarkdownIt() highlight callback, which improperly handles fenced-code language metadata by inserting it into HTML attributes without adequate escaping or consistent quoting. This flaw allows an attacker to execute JavaScript in the application origin when the crafted Markdown is rendered. If the host application persists the Markdown, this could lead to stored cross-site scripting.
Users can upgrade to md-editor-v3 version 6.5.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/imzbf/md-editor-v3/commit/2c07360420e74087f5bc63032ab155d93e0a0b10 | [email protected] | Source CodeVendor |
| https://github.com/imzbf/md-editor-v3/releases/tag/v6.5.4 | [email protected] | Release NotesVendor |
| https://github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| imzbf md-editor-v3 | <= 6.5.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | New CVE Received | [email protected] |
| Sep 18, 2026 | CVE Modified | CISA-ADP |