Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: Milkdown Clear all filters
TI-2026-41415 CVE-2026-57531 · GHSA-7jff-jg2j-4x95

Milkdown < 7.21.3 DOM XSS via innerHTML Assignment

Priority LOW 23

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by cau…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00405 Published 2026-07-24 Fixed in 7.21.3 CWE-79
TI-2026-41414 CVE-2026-57530 · GHSA-f8jw-52vm-m867

Milkdown < 7.21.3 Stored XSS via javascript: URL in link href

Priority LOW 23

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaS…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00314 Published 2026-07-24 Fixed in 7.21.3 CWE-79