CVE-2026-84992

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping or consistently quoting it. Both highlighted and non-highlighted rendering paths reach this return value, while XSSPlugin filters only existing html_block and html_inline tokens before rendering and therefore cannot inspect the renderer-generated HTML. An attacker who can supply Markdown can use crafted fenced-code metadata to execute JavaScript in the application origin when a victim renders it, including as stored cross-site scripting when the host persists the Markdown. This issue is fixed in version 6.5.4

• CWE-79

• https://github.com/imzbf/md-editor-v3/commit/2c07360420e74087f5bc63032ab155d93e0a0b10
• https://github.com/imzbf/md-editor-v3/releases/tag/v6.5.4
• https://github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6
• https://github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6

Published

Sep 18, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84970A numeric truncation weakness exists in the JSON parsing com…5.8
• CVE-2026-84971Improper handling of an unexpected value size in the decrypt…6.5
• CVE-2026-84975PJSIP is a free and open source multimedia communication lib…7.4
• CVE-2026-84989ntopng is a web-based network traffic monitoring application…7.1
• CVE-2026-8499The Helpfulcrowd Product Reviews plugin for WordPress is vul…5.3
• CVE-2026-84990ntopng is a web-based network traffic monitoring application…8.8
• CVE-2026-84993MikroORM is a TypeScript ORM for Node.js based on Data Mappe…6.5
• CVE-2026-84997react/http is an event-driven, streaming HTTP client and ser…7.5
• CVE-2026-8500Web::Passwd versions through 0.03 for Perl is vulnerable to …9.8
• CVE-2026-85006The HappyAddons for Elementor WordPress plugin before 3.50.…6.8
• CVE-2026-85008undici's cache interceptor documents that only safe HTTP met…5.3
• CVE-2026-85009The RestroPress WordPress plugin through 3.4.6 does not ver…6.5