DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-84992: CVE-2026-84992: Cross-Site Scripting (XSS) via Fenced Code Block Parsing in md-editor-v3

#security #cve #cybersecurity

CVE-2026-84992: Cross-Site Scripting (XSS) via Fenced Code Block Parsing in md-editor-v3

Vulnerability ID: CVE-2026-84992
CVSS Score: 6.1
Published: 2026-09-18

CVE-2026-84992 is a Cross-Site Scripting (XSS) vulnerability affecting md-editor-v3 before version 6.5.4. It occurs because the fenced-code block language parser directly interpolates unescaped language metadata into unquoted HTML attributes inside the custom rendering callback. This bypasses the built-in XSSPlugin which runs during the parsing phase, before rendering.

TL;DR

A Cross-Site Scripting (XSS) vulnerability exists in md-editor-v3 prior to version 6.5.4, allowing unauthenticated remote execution of client-side scripts via crafted Markdown containing malicious fenced-code headers.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network (AV:N)
  • CVSS Score: 6.1 (Medium)
  • Exploit Status: PoC / Theoretical
  • KEV Status: Not Listed
  • Impact: Client-side Script Execution / Session Hijacking

Affected Systems

  • md-editor-v3 package for Vue 3
  • Applications rendering untrusted Markdown using MdPreview or MdEditor in md-editor-v3
  • md-editor-v3: < 6.5.4 (Fixed in: 6.5.4)

Code Analysis

Commit: 2c07360

Fix: XSS vulnerability in fenced code parsing and useCopyCode innerHTML sink

Mitigation Strategies

  • Upgrade to md-editor-v3 version 6.5.4 or later.
  • Implement a robust Content Security Policy (CSP) blocking inline scripts ('unsafe-inline').
  • Apply post-rendering sanitization using DOMPurify on client-rendered HTML output.

Remediation Steps:

  1. Open your project directory and inspect package.json for 'md-editor-v3'.
  2. Execute the upgrade command: npm install md-editor-v3@6.5.4 or yarn upgrade md-editor-v3@6.5.4.
  3. Verify the installed version in your lockfile to ensure no vulnerable dependencies remain.
  4. Deploy the updated application to production environments.

References

Read the full report for CVE-2026-84992 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)