CVE-2026-84992: md-editor-v3: XSS via fenced-code language rendering bypass

September 18, 2026

MdPreview interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped XSSPlugin is enabled.

References

github.com/advisories/GHSA-3rm2-h79c-8qw6
github.com/imzbf/md-editor-v3/commit/2c07360420e74087f5bc63032ab155d93e0a0b10
github.com/imzbf/md-editor-v3/releases/tag/v6.5.4
github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6
nvd.nist.gov/vuln/detail/CVE-2026-84992

Code Behaviors & Features

Detect and mitigate CVE-2026-84992 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →