CVE-2026-48591

Name of the Vulnerable Software and Affected Versions pragdave earmark versions 1.4.1 and later

Description Improper neutralization of script in attributes in a web page allows stored cross-site scripting via unescaped HTML attribute values. The function make att1/2 in lib/earmark/transform.ex splices attribute values verbatim between double quotes. While text nodes are processed by an escape function that encodes double quotes as ", attribute values bypass this path. Consequently, a markdown link containing a double quote in the URL or title can close the attribute prematurely, allowing the browser to parse subsequent bytes as new HTML attributes and execute arbitrary JavaScript.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.