Junglewise Threat Intelligence

CVE-2026-57531: Milkdown DOM XSS in @milkdown/plugin-emoji

CVE-2026-57531 · Severity: medium · CVSS 5.4 · Published 2026-07-24

Executive brief

Milkdown is an open-source WYSIWYG markdown editor framework. A security flaw in its emoji plugin allows attackers to execute malicious scripts in a user's browser if the user pastes specially crafted content into the editor. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.

Technical details

A DOM cross-site scripting (XSS) vulnerability exists in the @milkdown/plugin-emoji package of the Milkdown editor. The vulnerability is rooted in the 'parseDOM.getAttrs' handler, which stores the raw innerHTML of pasted span elements (specifically those with data-type='emoji') without proper sanitization. During the markdown serialization process, the 'toMarkdown' runner assigns this unsanitized value directly to a live DOM element's innerHTML. This process bypasses the standard DOMPurify sanitization used in other paths, leading to arbitrary JavaScript execution whenever a markdown serialization cycle occurs. Attackers can exploit this by tricking a user into pasting malicious HTML content. The issue is resolved in version 7.21.3 by implementing sanitization at the 'parseDOM' entry point and using inert template elements during serialization.

Affected products

  • Milkdown milkdown < 7.21.3

Timeline

  • 2026-07-12: patched: Fix committed and version 7.21.3 released.
  • 2026-07-24: disclosed: CVE-2026-57531 published.

References

Related threats