CyberRota Analysis
AI-GeneratedThe @milkdown/plugin-emoji package in Milkdown versions prior to 7.21.3 is vulnerable to a DOM-based cross-site scripting (XSS) attack, allowing unauthenticated attackers to execute arbitrary JavaScript by manipulating pasted content. This vulnerability arises from the unsanitized handling of innerHTML in pasted emoji elements, which can lead to payload execution during markdown serialization. Developers and organizations using Milkdown should prioritize patching this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs handler stores raw innerHTML of pasted span elements with data-type="emoji" without sanitization, and the toMarkdown runner subsequently assigns this unsanitized value directly to a live DOM element's innerHTML, bypassing the DOMPurify sanitization used in the toDOM path, causing payload execution on every markdown serialization cycle.