CVE-2025-51691

Cross-Site Scripting (XSS) vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 (May 2025) allows a remote attacker to execute arbitrary code via a crafted script input to the editor interface. The application does not properly sanitize user-supplied Markdown before rendering it. Successful exploitation could lead to session hijacking, credential theft, or arbitrary client-side code execution in the context of the victim's browser.

• CWE-79

• https://github.com/0x72303074/CVE-Disclosures/tree/main/MarkTwo%20Markdown%20Editor/CVE-2025-51691
• https://github.com/anthonygarvan/marktwo
• https://marktwo.app/try-it-now

Published

Aug 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-51678An issue was discovered in RISC-V PicoRV32 commit 87c89a. A …7.5
• CVE-2025-5168A vulnerability was found in Open Asset Import Library Assim…5.5
• CVE-2025-51682mJobtime 15.7.2 handles authorization on the client side, wh…9.8
• CVE-2025-51683A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7…9.8
• CVE-2025-51684CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Script…6.1
• CVE-2025-5169A vulnerability classified as problematic has been found in …5.5
• CVE-2025-5170A vulnerability classified as critical was found in llisoft …9.8
• CVE-2025-5171A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-5172A vulnerability, which was classified as critical, was found…9.8
• CVE-2025-51726CyberGhostVPNSetup.exe (Windows installer) is signed using t…8.4
• CVE-2025-5173A vulnerability has been found in HumanSignal label-studio-m…7.8
• CVE-2025-51733Cross-Site Request Forgery (CSRF) vulnerability in HCL Techn…5.5