{"answers":{"affected":"2 open source packages ship an affected version, including md-editor-v3.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84992 exists.","fix":"Upgrade md-editor-v3 to 6.5.4 or later.","what":"CVE-2026-84992 is a medium-severity cross-site scripting vulnerability in imzbf md-editor-v3, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-84992 and fix it if it is affected.\n\nWhat it is: CVE-2026-84992 is a medium-severity cross-site scripting vulnerability in imzbf md-editor-v3, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84992 exists.\n\nAffected packages and fixed versions:\n- md-editor-v3 (npm): affected all versions; fixed in 6.5.4\n- md-editor-v3 (npm): affected all versions; fixed in 6.5.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-84992/ (Markdown: https://insights.sbomify.com/CVE-2026-84992/index.md)","id":"CVE-2026-84992","markdown":"https://insights.sbomify.com/CVE-2026-84992/index.md","name":"CVE-2026-84992","record":{"aliases":["GHSA-3rm2-h79c-8qw6"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Vue Markdown editor","requires_auth":"none","summary":"An attacker can execute JavaScript in the application origin by supplying crafted Markdown with malicious fenced-code language attributes to the md-editor-v3 library.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.1,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping or consistently quoting it. Both highlighted and non-highlighted rendering paths reach this return value, while XSSPlugin filters only existing html_block and html_inline tokens before rendering and therefore cannot inspect the renderer-generated HTML. An attacker who can supply Markdown can use crafted fenced-code metadata to execute JavaScript in the application origin when a victim renders it, including as stored cross-site scripting when the host persists the Markdown. This issue is fixed in version 6.5.4","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"md-editor-v3: XSS via fenced-code language rendering bypass","id":"CVE-2026-84992","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"xss","year":"2026"},"n_packages":2,"n_references":3,"next":{"headline":"MikroORM: SQL injection via unvalidated order direction in orderBy","id":"CVE-2026-84993"},"packages":[{"ecosystem":"npm","fixed":["6.5.4"],"introduced":["0"],"last_affected":[],"package":"md-editor-v3","purl":null,"source":"GHSA-3rm2-h79c-8qw6"},{"ecosystem":"npm","fixed":["6.5.4"],"introduced":["0"],"last_affected":[],"package":"md-editor-v3","purl":"pkg:npm/md-editor-v3","source":"GHSA-3rm2-h79c-8qw6"}],"prev":{"headline":"ntopng: Missing Authorization on System Configuration Backup Download and Listing","id":"CVE-2026-84990"},"products":["md-editor-v3"],"published":"2026-09-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-18","vendors":["imzbf"]},"summary":"An attacker can execute JavaScript in the application origin by supplying crafted Markdown with malicious fenced-code language attributes to the md-editor-v3 library.","url":"https://insights.sbomify.com/CVE-2026-84992/"}