CVE-2026-57531: Milkdown Plugin-Emoji XSS Vulnerability

CVE-2026-57531 Overview

CVE-2026-57531 is a DOM-based cross-site scripting (XSS) vulnerability [CWE-79] in the Milkdown WYSIWYG markdown editor. The flaw resides in the @milkdown/plugin-emoji package in versions before 7.21.3. The parseDOM.getAttrs handler stores the raw innerHTML of pasted span elements carrying data-type="emoji" without sanitization. The toMarkdown runner then assigns that unsanitized value directly to a live DOM element's innerHTML, bypassing the DOMPurify sanitization applied in the toDOM path. An unauthenticated attacker who convinces a victim to paste attacker-controlled content can execute arbitrary JavaScript in the host application's origin.

Critical Impact
Arbitrary JavaScript execution in the host application's origin every time the markdown document is serialized, enabling session theft, account takeover, and content manipulation.

Affected Products

Milkdown @milkdown/plugin-emoji versions prior to 7.21.3
Milkdown editor deployments using the emoji plugin for paste-driven content ingestion
Web applications embedding Milkdown that render user-supplied markdown content

Discovery Timeline

2026-07-24 - CVE-2026-57531 published to the National Vulnerability Database
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-57531

Vulnerability Analysis

Milkdown is a plugin-driven markdown editor framework built on ProseMirror. The @milkdown/plugin-emoji package handles paste events that include emoji-flavored HTML. Its parseDOM.getAttrs handler captures the innerHTML of pasted span[data-type="emoji"] elements and persists that raw string as a node attribute.

During markdown serialization, the toMarkdown runner writes that stored attribute directly to a live DOM element's innerHTML property. The write occurs outside the toDOM code path where DOMPurify sanitization runs. The result is that any script-bearing HTML preserved from paste is re-inflated as executable DOM on each serialization cycle.

Because serialization runs repeatedly as the user edits the document, the payload fires each cycle. The attack requires only that a victim paste attacker-supplied content into an editor instance.

Root Cause

The root cause is inconsistent sanitization between the two rendering paths. The toDOM path routes HTML through DOMPurify, but the toMarkdown path assigns the stored attribute to innerHTML without sanitization. Trust in a previously-sanitized value is misplaced because the value stored at getAttrs time was never sanitized.

Attack Vector

An attacker crafts an HTML fragment containing a span with data-type="emoji" and a malicious innerHTML payload such as an img tag with an onerror handler. The attacker delivers the fragment through any channel that supports rich clipboard content, then convinces the victim to paste it into a Milkdown editor. On the next serialization cycle, the payload executes in the origin hosting the editor.

typescript

// Security patch in packages/components/src/link-tooltip/edit/edit-view.ts
// fix: sanitize unsafe link hrefs and emoji html to prevent stored XSS (#2410)
 import { editorViewCtx } from '@milkdown/core'
 import { TooltipProvider } from '@milkdown/plugin-tooltip'
-import { linkSchema } from '@milkdown/preset-commonmark'
+import { linkSchema, sanitizeLinkHref } from '@milkdown/preset-commonmark'
 import { posToDOMRect } from '@milkdown/prose'
 import { TextSelection } from '@milkdown/prose/state'
-import DOMPurify from 'dompurify'
 import { createApp, ref, type App, type Ref } from 'vue'

Source: GitHub Commit db1ae72

Detection Methods for CVE-2026-57531

Indicators of Compromise

Pasted or stored markdown containing <span data-type="emoji"> elements whose innerHTML includes <script>, <img onerror=...>, or other event handlers
Unexpected outbound requests from browsers rendering Milkdown content to attacker-controlled domains
Anomalous JavaScript execution originating from the Milkdown editor iframe or component root

Detection Strategies

Scan stored markdown and database records for emoji nodes whose HTML attribute contains executable tags or event-handler attributes
Audit deployed @milkdown/plugin-emoji versions across build manifests and lockfiles to identify installations below 7.21.3
Deploy Content Security Policy (CSP) reporting endpoints to surface script executions that violate a strict script-src policy in editor-hosting pages

Monitoring Recommendations

Monitor client-side error and CSP violation reports for inline and unsafe-eval blocks originating from editor components
Track session anomalies such as unexpected token refreshes or API calls made from pages that embed Milkdown
Instrument paste handlers to log sanitizer decisions and flag unsanitized HTML attributes persisted on ProseMirror nodes

How to Mitigate CVE-2026-57531

Immediate Actions Required

Upgrade @milkdown/plugin-emoji and related Milkdown packages to version 7.21.3 or later
Purge existing stored documents of emoji nodes containing unsanitized HTML before restoring the plugin to production traffic
Apply a strict Content Security Policy that blocks inline event handlers on any page hosting the editor

Patch Information

The fix ships in Milkdown release v7.21.3 via pull request #2410 and commit db1ae72. The patch sanitizes emoji HTML and unsafe link href values before they are assigned to live DOM properties. See the VulnCheck Advisory for Milkdown for the full write-up.

Workarounds

Disable the @milkdown/plugin-emoji plugin until the upgrade to 7.21.3 is deployed
Strip span[data-type="emoji"] elements from clipboard input in a paste event handler before ProseMirror receives the fragment
Enforce a CSP script-src directive without 'unsafe-inline' and without permissive data: sources on editor-hosting routes

bash

# Update to the patched version using npm
npm install @milkdown/plugin-emoji@^7.21.3

# Or with pnpm / yarn
pnpm add @milkdown/plugin-emoji@^7.21.3
yarn add @milkdown/plugin-emoji@^7.21.3

# Verify the resolved version in the lockfile
npm ls @milkdown/plugin-emoji