Executive brief
Earmark is a library used by Elixir applications to convert Markdown text into HTML. A security flaw allows attackers to inject malicious scripts into web pages by using specially crafted Markdown links. Because the library is no longer maintained, no fix will be released, and users are advised to switch to an alternative library like MDEx to prevent potential account takeovers or data theft from their users.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the 'Elixir.Earmark.Transform':_make_att1/2 function within lib/earmark/transform.ex. The component splices attribute values verbatim into HTML without proper escaping, whereas text nodes are correctly escaped. An attacker can provide a Markdown link with a URL or title containing a double quote to break out of the HTML attribute and inject malicious event handlers (e.g., onerror). This allows for arbitrary JavaScript execution in the context of the victim's browser. The library is retired and unmaintained; users must migrate to MDEx as no patch is available.
Affected products
- pragdave earmark 1.4.1 and later
Timeline
- 2026-06-17: advisory: Advisory published by Erlang Ecosystem Foundation (EEF)