CVE-2026-84992: 
JavaScript vulnerability analysis and mitigation

CVE-2026-84992 is a stored/reflected Cross-Site Scripting (XSS) vulnerability in md-editor-v3, a Markdown editor for Vue 3. The flaw exists in the MdPreview component's useMarkdownIt() highlight callback, which inserts fenced-code language values into HTML class and language attributes without escaping or consistently quoting them. All versions up to and including 6.5.3 are affected; version 6.5.4 contains the fix. The vulnerability was first published by the maintainer on July 17, 2026, and added to the GitHub Advisory Database on September 18, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory, Security Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). In packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts (line ~206), the highlight callback constructs HTML by interpolating the raw fenced-code info string (language identifier) directly into class="language-${language}" and an unquoted language=${language} attribute — both without calling md.utils.escapeHtml(). Both the highlighted and non-highlighted rendering paths reach this unsafe return value. The bundled XSSPlugin only filters pre-existing html_block and html_inline tokens before rendering and therefore cannot inspect or sanitize HTML generated by the renderer itself, leaving this injection point completely unguarded. An attacker crafts a fenced-code block whose info string contains HTML-breaking characters (e.g., x"><details/open/ontoggle=alert(document.domain)>), which are passed through verbatim into the rendered output (Security Advisory, Fix Commit).

Successful exploitation allows an attacker who can supply Markdown content to execute arbitrary JavaScript in the application's origin when a victim renders the malicious content. This enables session hijacking, credential theft, DOM manipulation, and exfiltration of sensitive data accessible within the application context. When the host application persists attacker-supplied Markdown (e.g., in a wiki, CMS, or note-taking app), the vulnerability escalates to stored XSS, meaning every user who views the affected content is automatically targeted without further attacker interaction (Github Advisory).

A public proof-of-concept (PoC) exploit is available in the official security advisory, consisting of a complete, runnable Vue.js application demonstrating XSS execution via the malicious Markdown payload ```x"><details/open/ontoggle=alert(document.domain)> (Security Advisory). The exploit requires no authentication and no special privileges — only the ability to supply Markdown to a vulnerable MdPreview instance — but does require a victim to render the content (user interaction required). The EPSS score is 0.0, and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion at this time (Github Advisory).

1. Reconnaissance: Identify web applications using md-editor-v3 versions ≤ 6.5.3 (e.g., by inspecting package.json, npm lock files, or JavaScript bundle contents for the library name and version).
2. Identify Markdown input surface: Locate a feature in the target application where user-supplied Markdown is rendered via the MdPreview component — such as a comment box, wiki editor, note field, or content management interface.
3. Craft malicious fenced-code payload: Construct a Markdown snippet with a fenced-code block whose language/info string breaks out of the HTML attribute context:

   ```x"><details/open/ontoggle=alert(document.domain)>
   SAFE

4. Deliver the payload: Submit the crafted Markdown through the identified input surface. For stored XSS, save it as persistent content (e.g., a post, comment, or document).
5. Trigger execution: When a victim user navigates to the page rendering the malicious Markdown, the unescaped language value is injected into the HTML output, causing the browser to execute the embedded JavaScript (e.g., displaying alert(document.domain) or running a more harmful payload such as a cookie stealer or keylogger) (Security Advisory).

• Network: Outbound HTTP requests from victim browsers to attacker-controlled endpoints (e.g., for cookie/token exfiltration) originating from pages that render md-editor-v3 content; unexpected cross-origin requests in browser network logs.
• Logs: Server-side access logs showing submission of Markdown content containing patterns like "><, ontoggle=, onerror=, onload=, or <details within fenced-code info strings (the language field after the triple backtick).
• File System / Database: Stored Markdown records in the application database containing fenced-code blocks with HTML-breaking characters in the language identifier (e.g., ```x"><script> or ```x"><details/open/ontoggle=).
• Browser / Client-Side: Unexpected JavaScript alert() dialogs, console errors, or DOM mutations on pages rendering Markdown previews; browser developer tools showing injected <details>, <script>, or event-handler attributes within code block HTML output (Security Advisory).

Upgrade to md-editor-v3 version 6.5.4 or later, which escapes the fenced-code language value using md.utils.escapeHtml() before interpolation and properly quotes the language attribute (Release v6.5.4, Fix Commit). If immediate patching is not possible, restrict which users can supply or edit Markdown content rendered by MdPreview, and consider disabling the Markdown preview/editor functionality until the patch is applied. Do not rely on XSSPlugin alone as a mitigation, as it cannot inspect renderer-generated HTML and does not protect against this attack vector (Github Advisory).

The vulnerability was reported by security researcher koyokr and credited in the official advisory. The maintainer (imzbf) published the fix promptly in v6.5.4 on July 17, 2026, the same day the advisory was initially disclosed. No significant broader media coverage or notable public social media discussion has been identified beyond standard vulnerability database aggregation (Security Advisory).