Stored Cross-Site Scripting Vulnerability in Milkdown by Milkdown

CVE-2026-57530

What is CVE-2026-57530?

Milkdown versions prior to 7.21.3 are susceptible to a stored cross-site scripting vulnerability affecting the @milkdown/preset-commonmark and @milkdown/components packages. This flaw permits attackers with document write access to inject arbitrary JavaScript into the browser context of any user accessing the compromised document. The vulnerability arises from the parseMarkdown runner, which improperly stores raw URL values as href attributes without validating URL schemes. Consequently, the ineffective use of DOMPurify's sanitize function treats plain URL strings as text nodes, allowing malicious 'javascript:' payloads to bypass security measures, particularly in link-tooltip previews and read-only mode anchors.

References