CVE-2026-57530

Name of the Vulnerable Software and Affected Versions Milkdown versions prior to 7.21.3

Description A stored cross-site scripting issue exists in the @milkdown/preset-commonmark and @milkdown/components packages. Attackers with document write access can execute arbitrary JavaScript in the browser context of users who open the document or click a rendered link. This occurs because the parseMarkdown runner stores raw URL values from the remark AST as href mark attributes without validating the URL scheme. Additionally, a call to DOMPurify.sanitize() in edit-view.ts fails to sanitize bare URL strings, treating them as text nodes and allowing javascript: payloads to persist in the link-tooltip preview component and read-only mode anchor elements.

Recommendations Update to version 7.21.3 or later.