GHSA-vccx-p757-pv6h mo has a XSS via inline SVG script tags in Markdown rendering

Not scored Published 18 Mar 2026

Attackers can execute arbitrary JavaScript and exfiltrate data by tricking users into opening malicious Markdown files with inline SVG scripts.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-vccx-p757-pv6h?

GHSA-vccx-p757-pv6h is a cross-site scripting vulnerability in github.com/k1LoW/mo, published on 18 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Summary

When rendering Markdown files containing inline SVG elements with <script> tags, the embedded JavaScript is executed in the browser. This is due to rehype-raw passing raw HTML (including SVG) through to the DOM without sanitization.

PoC

&lt;svg&gt;&lt;script&gt;alert(1)&lt;/script&gt;&lt;/svg&gt;

Embedding the above in a Markdown file opened with mo causes the script to execute.

Impact

Arbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents.

Remediation

Fixed by adding rehype-sanitize to the Markdown rendering pipeline, which strips dangerous elements such as <script> while preserving safe HTML.

Which versions are affected by GHSA-vccx-p757-pv6h?

3 open source packages ship an affected version, including github.com/k1LoW/mo.

Package	Affected	Fixed in
`github.com/k1LoW/mo` Go	All versions	`0.18.5`
`github.com/k1LoW/mo` Go	All versions	`0.18.5`
`github.com/k1LoW/mo` Go	All versions	`0.18.5`

How do I fix GHSA-vccx-p757-pv6h?

Upgrade github.com/k1LoW/mo to 0.18.5 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is GHSA-vccx-p757-pv6h being exploited?

There is no known exploitation of GHSA-vccx-p757-pv6h in the wild and no public exploit code.

Sources

Also known as GO-2026-4765.