Executive brief
Editor.md is a popular open-source Markdown editor library used on websites to allow users to write and preview formatted content. The library contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious code via ABBR and SUP HTML elements. If a website uses Editor.md to process user input, an attacker can craft malicious content that executes JavaScript in visitors' browsers, potentially stealing session cookies, redirecting users, or defacing the website.
Technical details
The vulnerability is a stored or reflected cross-site scripting (XSS) flaw in pandao Editor.md 1.5.0, classified as CWE-79. The root cause is insufficient input sanitization: the library fails to filter event handler attributes (such as onmouseover) and style attributes on ABBR and SUP HTML elements during Markdown-to-HTML conversion. An attacker can inject payloads like "<sup onmouseover='alert(xss)'>" that execute arbitrary JavaScript when users interact with the rendered output. The attack requires no authentication and can be triggered through normal user interaction (e.g., mouse hover). No patch information is explicitly provided in the advisory, but users should upgrade to a patched version or apply manual HTML filtering to event handler attributes.
Affected products
- pandao Editor.md 1.5.0
Timeline
- 2019-08-02: disclosed
- 2019-08-23: advisory