CVE-2026-84992: Cross-Site Scripting (XSS) via Fenced Code Block Parsing in md-editor-v3

Vulnerability ID: CVE-2026-84992
CVSS Score: 6.1
Published: 2026-09-18

CVE-2026-84992 is a Cross-Site Scripting (XSS) vulnerability affecting md-editor-v3 before version 6.5.4. It occurs because the fenced-code block language parser directly interpolates unescaped language metadata into unquoted HTML attributes inside the custom rendering callback. This bypasses the built-in XSSPlugin which runs during the parsing phase, before rendering.

TL;DR

A Cross-Site Scripting (XSS) vulnerability exists in md-editor-v3 prior to version 6.5.4, allowing unauthenticated remote execution of client-side scripts via crafted Markdown containing malicious fenced-code headers.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-79
• Attack Vector: Network (AV:N)
• CVSS Score: 6.1 (Medium)
• Exploit Status: PoC / Theoretical
• KEV Status: Not Listed
• Impact: Client-side Script Execution / Session Hijacking

Affected Systems

• md-editor-v3 package for Vue 3
• Applications rendering untrusted Markdown using MdPreview or MdEditor in md-editor-v3
• md-editor-v3: < 6.5.4 (Fixed in: 6.5.4)

Code Analysis

Commit: 2c07360

Fix: XSS vulnerability in fenced code parsing and useCopyCode innerHTML sink

Mitigation Strategies

• Upgrade to md-editor-v3 version 6.5.4 or later.
• Implement a robust Content Security Policy (CSP) blocking inline scripts ('unsafe-inline').
• Apply post-rendering sanitization using DOMPurify on client-rendered HTML output.

Remediation Steps:

1. Open your project directory and inspect package.json for 'md-editor-v3'.
2. Execute the upgrade command: npm install [email protected] or yarn upgrade [email protected].
3. Verify the installed version in your lockfile to ensure no vulnerable dependencies remain.
4. Deploy the updated application to production environments.

References

• NVD Record for CVE-2026-84992
• CVE.org Authority Record
• GitHub Security Advisory GHSA-3rm2-h79c-8qw6
• Patch Commit
• Release v6.5.4 Changelog

Read the full report for CVE-2026-84992 on our website for more details including interactive diagrams and full exploit analysis.