Read the docs
TI-2026-58398 Aliases CVE-2026-84992GHSA-3rm2-h79c-8qw6

md-editor-v3: XSS via fenced-code language rendering bypass

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping or consistently quoting it. Both highlighted and non-highlighted rendering paths reach this return value, while XSSPlugin filters only existing html_block and html_inline tokens before rendering and therefore cannot inspect the renderer-generated HTML. An attacker who can supply Markdown can use crafted fenced-code metadata to execute JavaScript in the application origin when a victim renders it, including as stored cross-site scripting when the host persists the Markdown. This issue is fixed in version 6.5.4

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00327 25th percentileScored 2026-11-07
Fix Fixed md-editor-v3 (imzbf): 6.5.4md-editor-v3 (npm): 6.5.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
imzbfmd-editor-v3before 6.5.46.5.4Patch availableCNA
—md-editor-v3 (npm)before 6.5.46.5.4Patch availableGHSA-3rm2-h79c-8qw6
  • md-editor-v3 Vendorimzbf Affected before 6.5.4 Fixed in 6.5.4 Patch available CNA
  • md-editor-v3 (npm) Vendor— Affected before 6.5.4 Fixed in 6.5.4 Patch available GHSA-3rm2-h79c-8qw6

Remediation

  • Fix · CNA md-editor-v3 (imzbf) Fixed in 6.5.4
  • Fix · GHSA-3rm2-h79c-8qw6 md-editor-v3 (npm) Fixed in 6.5.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84992
  2. 2026-10-03 Alias added: GHSA-3rm2-h79c-8qw6

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences