CVE-2026-48591

Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values. 'Elixir.Earmark.Transform':_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: [" ", name, "=\"", value, "\""]. Text nodes are routed through the existing escape function which encodes " as &quot;, but attribute values never visit that path. A markdown link whose URL or title contains a bare " closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x" onerror="alert(1)) renders as <a href="http://example.com/?a=x" onerror="alert(1)">click</a>, executing arbitrary JavaScript in the victim's browser. The earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx. This issue affects earmark from 1.4.1 onward.

• CWE-83

• https://cna.erlef.org/cves/CVE-2026-48591.html
• https://osv.dev/vulnerability/EEF-CVE-2026-48591

Published

Jun 17, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48584Execution with unnecessary privileges in Azure Synapse allow…8.8
• CVE-2026-48586Improper Handling of Highly Compressed Data (Data Amplificat…7.5
• CVE-2026-48587An issue was discovered in Django 5.2 before 5.2.15 and 6.0 …5.3
• CVE-2026-48588An issue was discovered in Django 6.0 before 6.0.7 and 5.2 b…5.3
• CVE-2026-48589Apache Shiro’s Jakarta EE module used the HTTP Referer heade…5.4
• CVE-2026-4859The SP Blog Designer plugin for WordPress is vulnerable to S…6.4
• CVE-2026-48592Missing Authorization vulnerability in oban-bg oban_web ('El…5.3
• CVE-2026-48593Uncontrolled Resource Consumption vulnerability in oban-bg o…5.9
• CVE-2026-48594Improper Handling of Highly Compressed Data (Data Amplificat…8.2
• CVE-2026-48595Improper Handling of Case Sensitivity vulnerability in elixi…8.2
• CVE-2026-48596Improper Neutralization of CRLF Sequences in HTTP Headers ('…2.1
• CVE-2026-48597Allocation of Resources Without Limits or Throttling vulnera…8.2