Read the docs

Milkdown

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Milkdown records in CISA KEV

No Milkdown vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-41415 CVE-2026-57531 · GHSA-7jff-jg2j-4x95

Milkdown < 7.21.3 DOM XSS via innerHTML Assignment

Priority LOW 23

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by cau…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00405 Published 2026-07-24 Fixed in 7.21.3 CWE-79
TI-2026-41414 CVE-2026-57530 · GHSA-f8jw-52vm-m867

Milkdown < 7.21.3 Stored XSS via javascript: URL in link href

Priority LOW 23

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaS…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00314 Published 2026-07-24 Fixed in 7.21.3 CWE-79
Open these records in search →