Executive brief
md-editor-v3 is a popular Vue.js markdown editor and preview component used in web applications. An attacker who can supply markdown content can execute arbitrary JavaScript code in the browser of users viewing that content, potentially leading to account takeover, credential theft, or data exfiltration. This vulnerability affects applications that store or display user-supplied markdown, making it particularly dangerous in collaborative editing or content management scenarios.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the markdown preview rendering logic (CWE-79). The useMarkdownIt() function registers a highlight callback that inserts the fenced-code language identifier directly into HTML attributes without escaping—both as class="language-${language}" and as an unquoted language=${language} attribute. An attacker can craft a malicious markdown payload like ```x"><details/open/ontoggle=alert(document.domain)> that closes the attribute and injects arbitrary HTML/JavaScript. The vulnerability persists even when the shipped XSSPlugin is enabled, because the plugin only filters pre-existing html_block and html_inline tokens and cannot inspect HTML generated by the renderer callback. Attack vector is network-based with low complexity, requiring only that a victim render attacker-controlled markdown. Fix: escape the language string using md.utils.escapeHtml and quote the attribute. Version 6.5.4 and later contain the patch.
Affected products
- imzbf md-editor-v3 <= 6.5.3
Timeline
- 2026-09-18: disclosed: GHSA-3rm2-h79c-8qw6 published
- 2026-07-17: patched: Fix committed; version 6.5.4 released