Description
MdPreview interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped XSSPlugin is enabled.
Recommendation
Update the md-editor-v3 package to the latest compatible version. Followings are version details:
- Affected version(s): <= 6.5.3
- Patched version(s): 6.5.4
References
Could your website be exposed too?
SmartScanner can check your website for md-editor-v3: XSS via fenced-code language rendering bypass and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - CVE-2026-55661
- ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass - CVE-2026-84371
- Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix) - CVE-2026-73649
You might also like:
See something that needs correcting? Let us knowUpdated September 18, 2026