THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-3rm2-h79c-8qw6 (medium) — md-editor-v3: XSS via fenced-code language rendering bypass

[GHSA] GHSA-3rm2-h79c-8qw6 (medium) — md-editor-v3: XSS via fenced-code language rendering bypass

medgithub_advisoriesPublished 2026-09-18

GHSA-3rm2-h79c-8qw6 Severity: medium CVE: CVE-2026-84992

md-editor-v3: XSS via fenced-code language rendering bypass

### Summary `MdPreview` interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped `XSSPlugin` is enabled.

### Details `useMarkdownIt()` (`packages/MdEditor/layouts/Content/composition/us

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-84992cve

Original source: https://github.com/advisories/GHSA-3rm2-h79c-8qw6