---
id: CVE-2026-84992
title: md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript
summary: >-
  md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript.
  Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in
  packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a
  fenced-code language …
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: imzbf
product: md-editor-v3
affected:
  - md-editor-v3 < 6.5.4
patched:
  - md-editor-v3 6.5.4
published: '2026-09-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:17.277'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84992'
references:
  - url: >-
      https://github.com/imzbf/md-editor-v3/commit/2c07360420e74087f5bc63032ab155d93e0a0b10
    label: security-advisories@github.com
  - url: 'https://github.com/imzbf/md-editor-v3/releases/tag/v6.5.4'
    label: security-advisories@github.com
  - url: >-
      https://github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6
    label: security-advisories@github.com
  - url: >-
      https://github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-3rm2-h79c-8qw6'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - npm
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T18:06:01.191667Z'
aliases:
  - GHSA-3rm2-h79c-8qw6
ecosystem: npm
ingestedAt: '2026-09-18T17:46:41.529Z'
epss: 0.0023
epssPercentile: 0.14073
---

## Overview

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping or consistently quoting it. Both highlighted and non-highlighted rendering paths reach this return value, while XSSPlugin filters only existing html_block and html_inline tokens before rendering and therefore cannot inspect the renderer-generated HTML. An attacker who can supply Markdown can use crafted fenced-code metadata to execute JavaScript in the application origin when a victim renders it, including as stored cross-site scripting when the host persists the Markdown. This issue is fixed in version 6.5.4

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-84992)

Affected packages:

- `md-editor-v3 <= 6.5.3`

Patched in:

- `md-editor-v3 6.5.4`

Source: https://github.com/advisories/GHSA-3rm2-h79c-8qw6