Skip to content
OpenAdvisories

Vendor

Milkdown

2 known vulnerabilities.

Products

milkdown 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-57531

    Milkdown < 7.21.3 DOM XSS via innerHTML Assignment

    Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-control…

    Milkdown milkdown
  • Medium 5.4
    CVE-2026-57530

    Milkdown < 7.21.3 Stored XSS via javascript: URL in link href

    Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any use…

    Milkdown milkdown