Stored Cross-Site Scripting Vulnerability in Pragdave Earmark Library

CVE-2026-48591

What is CVE-2026-48591?

The Pragdave Earmark library exhibits a vulnerability that allows for stored cross-site scripting (XSS) due to improper handling of HTML attribute values. Specifically, when a markdown link’s URL or title contains an unescaped double quote, it prematurely terminates the attribute and permits the browser to process subsequent bytes as authenticated HTML attributes. This can enable attackers to execute arbitrary JavaScript in the victim's browser, which poses a significant risk of compromising user data and security. Notably, the Earmark library is no longer maintained, with no patched versions released; therefore, users are strongly advised to migrate to an actively maintained Markdown library such as MDEx.

References