Vulnerability · Published Jul 24, 2026 · Assigned by VulnCheck

CVE-2026-57530Milkdown < 7.21.3 Stored XSS via javascript: URL in link href

Medium 5.4

In plain English

A medium-severity cross-site scripting in milkdown from Milkdown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 75.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a rendered link. The parseMarkdown runner stores raw URL values from the remark AST as href mark attributes without URL scheme validation, and the ineffective DOMPurify.sanitize call in edit-view.ts treats the bare URL string as a text node and returns it unchanged, allowing javascript: payloads to pass through the link-tooltip preview component and read-only mode anchor elements unmodified.

Affected products (as reported)

Vendor	Product	Versions
Milkdown	milkdown	0 – before 7.21.3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

Milkdown 7.21.3 Release Notes release-notes, patch
Pull Request issue-tracking, patch
Patch Commit patch
@milkdown/preset-commonmark product
@milkdown/components product
https://www.vulncheck.com/advisories/milkdown-stored-xss-via-javascript-url-in-link-href third-party-advisory