CVE-2026-84992

Name of the Vulnerable Software and Affected Versions md-editor-v3 versions prior to 6.5.4

Description MdPreview fails to escape or consistently quote the fenced-code language value when inserting it into class and language HTML attributes within the useMarkdownIt() highlight callback. Because the XSSPlugin only filters existing html block and html inline tokens before rendering, it cannot inspect the HTML generated by the renderer. An attacker providing crafted Markdown can use fenced-code metadata to execute arbitrary JavaScript in the application origin when a victim renders the content, potentially leading to stored cross-site scripting if the host persists the Markdown.

Recommendations Update md-editor-v3 to version 6.5.4.