CVE-2026-84992: md-editor-v3 XSS Vulnerability

CVE-2026-84992 Overview

CVE-2026-84992 is a stored cross-site scripting (XSS) vulnerability in md-editor-v3, a Markdown editor for Vue 3 written in JSX and TypeScript. Versions prior to 6.5.4 fail to escape fenced-code language metadata before inserting it into class and language HTML attributes inside the MdPreview component. An attacker who can submit Markdown content can craft fenced-code metadata that breaks out of the attribute context and executes JavaScript in the origin of the rendering application. When the host application persists the Markdown, the flaw becomes a stored XSS affecting every viewer of the content.

Critical Impact
Attacker-supplied Markdown can execute arbitrary JavaScript in the application origin, enabling session theft, account takeover, and stored XSS in any host that saves user Markdown.

Affected Products

md-editor-v3 versions prior to 6.5.4
Vue 3 applications embedding the MdPreview component
Web applications persisting user-supplied Markdown rendered by md-editor-v3

Discovery Timeline

2026-09-18 - CVE-2026-84992 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-84992

Vulnerability Analysis

The flaw resides in the useMarkdownIt() highlight callback located at packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts. The callback interpolates the language identifier taken from a fenced-code block directly into HTML class and language attributes. The value is not HTML-escaped, and quoting is applied inconsistently, so a specially crafted language string can terminate the attribute and inject additional handlers such as onerror or onload.

Both the syntax-highlighted rendering path and the fallback non-highlighted rendering path reach the same unsafe return value. As a result, disabling highlighting does not remove the vector. The classification maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Root Cause

The XSSPlugin bundled with md-editor-v3 only inspects html_block and html_inline tokens produced by markdown-it before rendering. HTML that the renderer itself generates from fenced-code metadata is never passed through the sanitizer, so language identifiers reach the DOM untouched. The security boundary assumed by the plugin does not cover renderer-produced markup.

Attack Vector

An unauthenticated attacker submits Markdown that includes a fenced-code block whose language token contains attribute-breaking characters and an event handler payload. When a victim opens a page that renders the Markdown through MdPreview, the browser parses the injected handler and executes JavaScript in the site's origin. Because the vulnerability activates during rendering, stored XSS occurs on any platform that saves the Markdown for later display. The attack requires user interaction to view the crafted content and can cross security scopes.

typescript

// Patch excerpt: packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts
// fix(preview): escape code fence metadata in preview output
  toRef,
  watch
} from 'vue';
+
+import useEcharts from './useEcharts';
+import useHighlight from './useHighlight';
+import useKatex from './useKatex';
+import useMermaid from './useMermaid';
+
+import { ContentPreviewProps } from '../ContentPreview';
+import AdmonitionPlugin from '../markdownIt/admonition';
+import CodePlugin from '../markdownIt/code';
+import EchartsPlugin from '../markdownIt/echarts';
+import HeadingPlugin from '../markdownIt/heading';
+import KatexPlugin from '../markdownIt/katex';
+import MermaidPlugin from '../markdownIt/mermaid';
+import TaskListPlugin from '../markdownIt/task';
import { globalConfig, prefix } from '~/config';

Source: GitHub Commit 2c07360

Detection Methods for CVE-2026-84992

Indicators of Compromise

Rendered HTML containing <pre> or <code> elements whose class or language attributes include quote characters, angle brackets, or on* event handlers.
Persisted Markdown records containing fenced-code fences (```) followed by language tokens that embed HTML metacharacters such as ", ', >, or <.
Content Security Policy (CSP) violation reports referencing inline script execution originating from Markdown preview pages.

Detection Strategies

Scan stored Markdown fields for fenced-code language identifiers that do not match a strict alphanumeric allowlist (^[A-Za-z0-9_-]+$).
Add regression tests that render known-malicious language tokens through MdPreview and assert that no on* attributes appear in the resulting DOM.
Enable browser-side runtime monitoring for unexpected script execution on pages that display user Markdown.

Monitoring Recommendations

Forward CSP violation reports to a centralized log store and alert on inline-script violations from preview routes.
Track the installed version of md-editor-v3 across build manifests and flag any deployment still using a release earlier than 6.5.4.
Audit web application logs for spikes in Markdown submissions containing triple-backtick sequences paired with attribute-terminating characters.

How to Mitigate CVE-2026-84992

Immediate Actions Required

Upgrade md-editor-v3 to version 6.5.4 or later across all applications, including transitive dependencies.
Invalidate active sessions and rotate authentication tokens for users who may have viewed attacker-controlled Markdown.
Review persisted Markdown for malicious fenced-code metadata and quarantine suspicious records before re-rendering.

Patch Information

The issue is fixed in md-editor-v3 version 6.5.4. The corrective commit escapes fenced-code metadata before it is inserted into HTML attributes in the preview output. Review the GitHub Security Advisory GHSA-3rm2-h79c-8qw6, the GitHub Release v6.5.4 notes, and the upstream patch commit for full remediation details.

Workarounds

Apply a strict Content Security Policy that disallows inline scripts and event handlers on pages that render user Markdown.
Preprocess submitted Markdown server-side to strip fenced-code language tokens containing characters outside [A-Za-z0-9_-].
Post-process rendered HTML with a hardened DOM sanitizer such as DOMPurify before returning it to clients when upgrading is not immediately possible.

bash

# Upgrade md-editor-v3 to the patched release
npm install md-editor-v3@6.5.4

# Verify installed version
npm list md-editor-v3