DOM Cross-Site Scripting Vulnerability in Milkdown by Milkdown

CVE-2026-57531

What is CVE-2026-57531?

Milkdown versions before 7.21.3 are susceptible to a DOM-based cross-site scripting vulnerability within the @milkdown/plugin-emoji package. This flaw enables unauthenticated attackers to execute arbitrary JavaScript code by manipulating the content that victims paste into applications utilizing the plugin. Specifically, the vulnerability arises due to the parseDOM.getAttrs handler, which improperly handles raw innerHTML of pasted emoji span elements without adequate sanitization. As a result, malicious scripts can be directly injected into the live DOM by exploiting the toMarkdown runner, effectively bypassing the protection provided by DOMPurify, and leading to payload execution during markdown serialization. Users of Milkdown should update to the latest version to mitigate exposure to this vulnerability.

References