GHSA-3rm2-h79c-8qw6: XSS
Summary MdPreview interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped XSSPlugin is enabled.
Details useMarkdownIt() (packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts:206) registers a highlight callback whose final return inserts language into both class="language-${language}" and an unquoted language=${language} attribute without escaping. Both highlighting paths reach this return. XSSPlugin() filters only existing htmlblock and htmlinline tokens before rendering, so it cannot inspect this renderer-generated HTML.
PoC The Vue application enables the shipped XSSPlugin and renders attacker-controlled Markdown. noHighlight: true only makes reproduction deterministic; the default highlighting path reaches the same unsafe return. Use this as src/main.js:
js import { createApp, h } from 'vue'; import { MdPreview, XSSPlugin, config } from 'md-editor-v3';
config({ markdownItPlugins: p => [...p, { type: 'xss', plugin: XSSPlugin, options: {} }] }); const markdown = 'x"><details/open/ontoggle=alert(document.domain)>\nSAFE\n'; createApp({ render: () => h(MdPreview, { editorId: 'poc', modelValue: markdown, noHighlight: true }) }).mount('#app');
Create and run the app, replacing src/main.js when indicated:
sh npm create vite@latest poc -- --template vue cd poc npm install npm install md-editor-v3@6.5.3 Replace src/main.js with the code above. npm run dev
Opening the displayed URL automatically shows the application hostname in an alert.
Impact An attacker who can supply Markdown can execute JavaScript in the application origin when a victim renders it. If the host stores that Markdown, this becomes stored XSS.
Suggested fix Escape language with md.utils.escapeHtml before interpolation and quote the language attribute. Add this payload and the raw control as regression tests with XSSPlugin enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/md-editor-v3to a version that resolves this vulnerability.Fixed in 6.5.4 - Configuration
In your app setup (e.g., via config({ markdownItPlugins: p => [...p, { type: 'xss', plugin: XSSPlugin, options: {} }] })), do not enable the shipped XSSPlugin. The material states the Vue application enables the shipped XSSPlugin and renders attacker-controlled Markdown.
md-editor-v3 (Vue app using MdPreview) markdownItPlugins (register XSSPlugin) = remove/stop enabling { type: 'xss', plugin: XSSPlugin, options: {} } - Configuration
Update the renderer/interpolation logic so that the fenced-code language is escaped with md.utils.escapeHtml before it is interpolated into HTML attributes, and ensure the `language` attribute is quoted. The material states: “Escape `language` with `md.utils.escapeHtml` before interpolation and quote the `language` attribute.”
md-editor-v3 MdPreview / Markdown-It highlight callback Escape fenced-code language before interpolation (language attribute) = md.utils.escapeHtml(language) and quote the language attribute value
Event History
Frequently Asked Questions
Does enabling the shipped XSSPlugin prevent exploitation?
No. XSSPlugin filters existing html_block and html_inline tokens, but the unsafe HTML is generated later by the highlight renderer, so the plugin cannot inspect or sanitize it.
Are applications using the default highlighting behavior affected?
Yes. Although noHighlight: true makes the proof of concept deterministic, both the no-highlight and default highlighting paths reach the unsafe return that interpolates the fenced-code language.
What must an attacker control to exploit this issue?
The attacker needs to supply Markdown that is rendered by MdPreview and can set a fenced code block's info-string language. Exploitation also requires user interaction, as reflected by the UI:R vector.
How can I identify the unsafe implementation in a local copy?
Inspect useMarkdownIt.ts for the highlight callback near packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts:206. The affected behavior returns HTML containing the language value in both class="language-${language}" and an unquoted language=${language} attribute without escaping.