CVE-2026-57531

Name of the Vulnerable Software and Affected Versions Milkdown versions prior to 7.21.3

Description A DOM cross-site scripting issue exists in the @milkdown/plugin-emoji package. Unauthenticated attackers can execute arbitrary JavaScript in the host application origin by tricking a victim into pasting attacker-controlled content. The parseDOM.getAttrs handler stores the raw innerHTML of pasted span elements containing data-type="emoji" without sanitization. Subsequently, the toMarkdown runner assigns this unsanitized value directly to a live DOM element's innerHTML, which bypasses the DOMPurify sanitization used in the toDOM path and triggers payload execution during every markdown serialization cycle.

Recommendations Update to version 7.21.3 or later.