CVE-2026-84992: Cross-Site Scripting (XSS) via Fenced Code Block Parsing in md-editor-v3

The md-editor-v3 package is a Markdown editor designed for Vue 3, implemented using JSX and TypeScript. It relies on the popular markdown-it parsing engine to transform Markdown inputs into structured HTML output. This parsing flow exposes an attack surface when processing user-defined metadata associated with fenced code blocks.

The vulnerability, tracked as CVE-2026-84992, represents an improper neutralization of input during web page generation, specifically a Cross-Site Scripting (XSS) vulnerability. The flaw resides in how the editor extracts and processes the language identifier from fenced code blocks inside its custom renderer logic. When the renderer constructs the wrapper HTML, it fails to sanitize or properly quote the extracted language metadata before inserting it into the final DOM container.

Applications utilizing md-editor-v3 for displaying user-generated content, such as discussion boards, comments, or documentation platforms, are directly exposed to this vulnerability. An attacker can exploit this flaw to execute arbitrary client-side script code in the context of the victim's browser session.

The technical root cause of CVE-2026-84992 lies in the custom rendering configuration of the markdown-it instance defined in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts. In markdown parsing, fenced code blocks are defined by triple backticks followed by an optional info string denoting the programming language. The editor extracts this info string and assigns it to a variable representing the language.

During the rendering pass, the custom hook generates a raw HTML string using standard ES6 template literals. The extracted language variable is interpolated directly into two locations: the class attribute of the code tag and a custom language attribute of the same tag. Crucially, the custom language attribute is defined without surrounding double or single quotes, resulting in the structure: language=${language}.

Furthermore, the application's built-in defense mechanism, XSSPlugin, fails to catch this injection. The XSSPlugin is registered as a token-level filter that sanitizes explicit inline HTML tokens (html_block and html_inline) before the final rendering stage. Because the custom code-fence renderer operates during the rendering execution phase itself, it generates new HTML markup after the token-level sanitization pass is complete. This architectural order of operations effectively bypasses the built-in XSS filter entirely.

An examination of the vulnerable implementation in useMarkdownIt.ts reveals the structural flaw in the code block renderer. The renderer constructs the returned HTML string using raw concatenation of the unescaped language variable.

// Vulnerable implementation in useMarkdownIt.ts
return `<pre><code class="language-${language}" language=${language}>${codeSpan}</code></pre>`;

In this structure, the lack of quotes around the second language attribute allows space-separated arguments to be interpreted as distinct HTML attributes by the browser's parser. In addition, the lack of HTML escaping means characters like double quotes can break out of the class attribute string.

The patch introduced in commit 2c07360420e74087f5bc63032ab155d93e0a0b10 corrects this behavior by introducing strict HTML escaping and proper quoting of attributes. The updated code utilizes the utility function md.utils.escapeHtml to neutralize any dangerous characters prior to interpolation.

// Patched implementation in useMarkdownIt.ts
const escapedLanguage = md.utils.escapeHtml(language);
return `<pre><code class="language-${escapedLanguage}" language="${escapedLanguage}">${codeSpan}</code></pre>`;

This patch successfully prevents attribute breakout by converting character literals such as " to ", < to <, and > to >. Additionally, a parallel DOM-based vulnerability was addressed in useCopyCode.ts where visual text updates were shifted from the dangerous innerHTML sink to the safe textContent API, neutralizing downstream DOM manipulation vectors.

Exploiting CVE-2026-84992 is straightforward and requires no prior privileges or complex authentication, assuming the target application accepts user-controlled Markdown. The attacker constructs a markdown payload utilizing a fenced code block with a custom language attribute designed to inject malicious HTML handlers.

The payload leverages the unquoted attribute in the generated HTML to append custom event handlers, such as onmouseover or onload, alongside a style block that stretches the element across the entire viewport. A schematic representation of the exploit payload is detailed below:

```js"onmouseover="alert(document.domain)"style="display:block;width:100vw;height:100vh;position:fixed;top:0;left:0;"
// Exploit payload triggers on mouse movement

When parsed by the vulnerable version of md-editor-v3, this Markdown is processed into the following raw HTML output:

<pre><code class="language-js"onmouseover="alert(document.domain)"style="display:block;width:100vw;height:100vh;position:fixed;top:0;left:0;"" language=js"onmouseover="alert(document.domain)"style="display:block;width:100vw;height:100vh;position:fixed;top:0;left:0;"">...</code></pre>

In this output, the browser interprets the first double quote in the input as the closing quote for the class attribute. The subsequent string onmouseover="alert(document.domain)" is processed as a standard event handler. The injected inline CSS ensures that the code element fills the entire browser window, forcing an immediate execution of the script as soon as the user moves their mouse over any part of the page.

The impact of this vulnerability is classified as Medium, receiving a CVSS v3.1 base score of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The scope is changed (S:C) because the execution of script content occurs within the context of the user's browser, allowing access to resources outside the direct scope of the editor itself.

By executing arbitrary JavaScript in the user's browser, an attacker can access session identifiers, cookies, local storage tokens, or other sensitive information. If the target application relies on session cookies without the HttpOnly flag, the attacker can hijack active sessions and impersonate the victim.

Furthermore, the attacker can perform unauthorized actions on behalf of the user, such as modifying profile data, submitting form requests, or executing DOM-based modifications (defacement). In highly privileged sessions (e.g., administrator panels), this could lead to full control over application state or user accounts.

Organizations can detect vulnerable instances of md-editor-v3 by auditing dependency trees within node projects. Searching lockfiles (package-lock.json, yarn.lock, or pnpm-lock.yaml) for references to md-editor-v3 with versions prior to 6.5.4 will pinpoint vulnerable deployments.

The recommended mitigation is to upgrade the md-editor-v3 package to version 6.5.4 or later, which contains the complete fix. The patch resolves the vulnerability by properly sanitizing metadata inputs and switching the active UI rendering endpoints to safe DOM interfaces.

In scenarios where upgrading the package is not immediately possible, applications can implement a Content Security Policy (CSP) that restricts script execution. Specifically, removing the 'unsafe-inline' directive from the script-src policy will prevent the browser from executing event handlers injected through the attribute breakout. Alternatively, applying post-rendering sanitization using a library like DOMPurify on the HTML generated by the editor can act as an effective secondary line of defense.