Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| md-editor-v3 | npm | <= 6.5.3 | 6.5.4 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-84992, describes an XSS flaw in md-editor-v3 where a crafted fenced-code language string can lead to JavaScript execution. The core issue lies in the useMarkdownIt() function, specifically within a highlight callback it registers. This callback was responsible for generating HTML for code blocks and was interpolating the language variable directly into class and language attributes without proper HTML escaping. This allowed an attacker to inject malicious HTML attributes, such as ontoggle=alert(document.domain), which would execute JavaScript when the element was rendered and interacted with. The XSSPlugin shipped with the editor was ineffective against this vulnerability because it only filtered existing html_block and html_inline tokens, not the renderer-generated HTML. The provided patch 2c07360420e74087f5bc63032ab155d93e0a0b10 directly addresses this by introducing md.utils.escapeHtml(language) to sanitize the language variable before it's inserted into the HTML output, and also by quoting the language attribute. The highlight callback is the precise function that would appear in a runtime profiler when this vulnerability is triggered, as it's the code path responsible for processing the language input and generating the vulnerable HTML.
highlightpackages/MdEditor/layouts/Content/composition/useMarkdownIt.ts