https://vulnerability.circl.lu/sightings/feed 2026-09-20T20:59:35.591452+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/18ea1735-6c46-417c-9a65-726847e0478d/export 2026-09-20T20:59:35.616848+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "18ea1735-6c46-417c-9a65-726847e0478d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84992", "type": "seen", "source": "https://gist.github.com/alon710/bea1abe85bdbc7360f709e8ba11f8e2a", "content": "# CVE-2026-84992: CVE-2026-84992: Cross-Site Scripting (XSS) via Fenced Code Block Parsing in md-editor-v3\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84992\n\n## Summary\nCVE-2026-84992 is a Cross-Site Scripting (XSS) vulnerability affecting md-editor-v3 before version 6.5.4. It occurs because the fenced-code block language parser directly interpolates unescaped language metadata into unquoted HTML attributes inside the custom rendering callback. This bypasses the built-in XSSPlugin which runs during the parsing phase, before rendering.\n\n## TL;DR\nA Cross-Site Scripting (XSS) vulnerability exists in md-editor-v3 prior to version 6.5.4, allowing unauthenticated remote execution of client-side scripts via crafted Markdown containing malicious fenced-code headers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.1 (Medium)\n- **Exploit Status**: PoC / Theoretical\n- **KEV Status**: Not Listed\n- **Impact**: Client-side Script Execution / Session Hijacking\n\n## Affected Systems\n\n- md-editor-v3 package for Vue 3\n- Applications rendering untrusted Markdown using MdPreview or MdEditor in md-editor-v3\n- **md-editor-v3**: < 6.5.4 (Fixed in: `6.5.4`)\n\n## Mitigation\n\n- Upgrade to md-editor-v3 version 6.5.4 or later.\n- Implement a robust Content Security Policy (CSP) blocking inline scripts ('unsafe-inline').\n- Apply post-rendering sanitization using DOMPurify on client-rendered HTML output.\n\n**Remediation Steps:**\n1. Open your project directory and inspect package.json for 'md-editor-v3'.\n2. Execute the upgrade command: `npm install md-editor-v3@6.5.4` or `yarn upgrade md-editor-v3@6.5.4`.\n3. Verify the installed version in your lockfile to ensure no vulnerable dependencies remain.\n4. Deploy the updated application to production environments.\n\n## References\n\n- [NVD Record for CVE-2026-84992](https://nvd.nist.gov/vuln/detail/CVE-2026-84992)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-84992)\n- [GitHub Security Advisory GHSA-3rm2-h79c-8qw6](https://github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6)\n- [Patch Commit](https://github.com/imzbf/md-editor-v3/commit/2c07360420e74087f5bc63032ab155d93e0a0b10)\n- [Release v6.5.4 Changelog](https://github.com/imzbf/md-editor-v3/releases/tag/v6.5.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84992) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T11:31:49.543770Z"} 2026-09-19T11:31:49.543770+00:00 https://vulnerability.circl.lu/sighting/29d751a2-127c-40a6-9beb-917d6d2e7742/export 2026-09-20T20:59:35.619761+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "29d751a2-127c-40a6-9beb-917d6d2e7742", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-84992", "type": "published-proof-of-concept", "source": "https://github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6", "content": "", "creation_timestamp": "2026-09-18T18:35:10.009077Z"} 2026-09-18T18:35:10.009077+00:00