Search
Find a vulnerability
Search criteria
2 vulnerabilities by pragdave
CVE-2026-48591 (GCVE-0-2026-48591)
Vulnerability from nvd – Published: 2026-06-17 16:42 – Updated: 2026-06-18 04:45
VLAI
EPSS
VEX
Title
Stored XSS via unescaped HTML attribute values in earmark
Summary
Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.
'Elixir.Earmark.Transform':_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: [" ", name, "=\"", value, "\""]. Text nodes are routed through the existing escape function which encodes " as ", but attribute values never visit that path. A markdown link whose URL or title contains a bare " closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x" onerror="alert(1)) renders as <a href="http://example.com/?a=x" onerror="alert(1)">click</a>, executing arbitrary JavaScript in the victim's browser.
The earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.
This issue affects earmark from 1.4.1 onward.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-83 - Improper Neutralization of Script in Attributes in a Web Page
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cna.erlef.org/cves/CVE-2026-48591.html | relatedthird-party-advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-48591 | related |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48591",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-17T18:25:40.841347Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T18:25:55.606Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Earmark.Transform\u0027"
],
"packageName": "earmark",
"packageURL": "pkg:hex/earmark",
"product": "earmark",
"programFiles": [
"lib/earmark/transform.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Earmark.Transform\u0027:_make_att1/2"
}
],
"repo": "https://github.com/pragdave/earmark",
"vendor": "pragdave",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "1.4.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Earmark.Transform\u0027"
],
"packageName": "pragdave/earmark",
"packageURL": "pkg:github/pragdave/earmark",
"product": "earmark",
"programFiles": [
"lib/earmark/transform.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Earmark.Transform\u0027:_make_att1/2"
}
],
"repo": "https://github.com/pragdave/earmark",
"vendor": "pragdave",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "8236a0570bd894b50e360da08131ec3294c20799",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Robert Dober"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.\u003c/p\u003e\u003cp\u003e\u003ctt\u003e\u0027Elixir.Earmark.Transform\u0027:_make_att1/2\u003c/tt\u003e in \u003ctt\u003elib/earmark/transform.ex\u003c/tt\u003e splices attribute values verbatim between two literal \u003ctt\u003e\"\u003c/tt\u003e bytes: \u003ctt\u003e[\" \", name, \"=\\\"\" , value, \"\\\"\"]\u003c/tt\u003e. Text nodes are routed through the existing escape function which encodes \u003ctt\u003e\"\u003c/tt\u003e as \u003ctt\u003e\u0026amp;quot;\u003c/tt\u003e, but attribute values never visit that path. A markdown link whose URL or title contains a bare \u003ctt\u003e\"\u003c/tt\u003e closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, \u003ctt\u003e[click](http://example.com/?a=x\" onerror=\"alert(1))\u003c/tt\u003e renders as \u003ctt\u003e\u0026lt;a href=\"http://example.com/?a=x\" onerror=\"alert(1)\"\u0026gt;click\u0026lt;/a\u0026gt;\u003c/tt\u003e, executing arbitrary JavaScript in the victim\u0027s browser.\u003c/p\u003e\u003cp\u003eThe earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.\u003c/p\u003e\u003cp\u003eThis issue affects earmark from 1.4.1 onward.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.\n\n\u0027Elixir.Earmark.Transform\u0027:_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal \" bytes: [\" \", name, \"=\\\"\", value, \"\\\"\"]. Text nodes are routed through the existing escape function which encodes \" as \u0026quot;, but attribute values never visit that path. A markdown link whose URL or title contains a bare \" closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x\" onerror=\"alert(1)) renders as \u003ca href=\"http://example.com/?a=x\" onerror=\"alert(1)\"\u003eclick\u003c/a\u003e, executing arbitrary JavaScript in the victim\u0027s browser.\n\nThe earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.\n\nThis issue affects earmark from 1.4.1 onward."
}
],
"impacts": [
{
"capecId": "CAPEC-243",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-243 XSS Targeting HTML Attributes"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-83",
"description": "CWE-83 Improper Neutralization of Script in Attributes in a Web Page",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T04:45:59.864Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"related",
"third-party-advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48591.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48591"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored XSS via unescaped HTML attribute values in earmark",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMigrate to a maintained Markdown library such as \u003ca href=\"https://hex.pm/packages/mdex\"\u003eMDEx\u003c/a\u003e. The earmark package has been retired on Hex and no patched release will be made.\u003c/p\u003e"
}
],
"value": "Migrate to a maintained Markdown library such as MDEx (https://hex.pm/packages/mdex). The earmark package has been retired on Hex and no patched release will be made."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-48591",
"datePublished": "2026-06-17T16:42:37.508Z",
"dateReserved": "2026-05-22T09:36:56.834Z",
"dateUpdated": "2026-06-18T04:45:59.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48591 (GCVE-0-2026-48591)
Vulnerability from cvelistv5 – Published: 2026-06-17 16:42 – Updated: 2026-06-18 04:45
VLAI
EPSS
VEX
Title
Stored XSS via unescaped HTML attribute values in earmark
Summary
Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.
'Elixir.Earmark.Transform':_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: [" ", name, "=\"", value, "\""]. Text nodes are routed through the existing escape function which encodes " as ", but attribute values never visit that path. A markdown link whose URL or title contains a bare " closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x" onerror="alert(1)) renders as <a href="http://example.com/?a=x" onerror="alert(1)">click</a>, executing arbitrary JavaScript in the victim's browser.
The earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.
This issue affects earmark from 1.4.1 onward.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-83 - Improper Neutralization of Script in Attributes in a Web Page
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cna.erlef.org/cves/CVE-2026-48591.html | relatedthird-party-advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-48591 | related |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48591",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-17T18:25:40.841347Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T18:25:55.606Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Earmark.Transform\u0027"
],
"packageName": "earmark",
"packageURL": "pkg:hex/earmark",
"product": "earmark",
"programFiles": [
"lib/earmark/transform.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Earmark.Transform\u0027:_make_att1/2"
}
],
"repo": "https://github.com/pragdave/earmark",
"vendor": "pragdave",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "1.4.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Earmark.Transform\u0027"
],
"packageName": "pragdave/earmark",
"packageURL": "pkg:github/pragdave/earmark",
"product": "earmark",
"programFiles": [
"lib/earmark/transform.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Earmark.Transform\u0027:_make_att1/2"
}
],
"repo": "https://github.com/pragdave/earmark",
"vendor": "pragdave",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "8236a0570bd894b50e360da08131ec3294c20799",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Robert Dober"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.\u003c/p\u003e\u003cp\u003e\u003ctt\u003e\u0027Elixir.Earmark.Transform\u0027:_make_att1/2\u003c/tt\u003e in \u003ctt\u003elib/earmark/transform.ex\u003c/tt\u003e splices attribute values verbatim between two literal \u003ctt\u003e\"\u003c/tt\u003e bytes: \u003ctt\u003e[\" \", name, \"=\\\"\" , value, \"\\\"\"]\u003c/tt\u003e. Text nodes are routed through the existing escape function which encodes \u003ctt\u003e\"\u003c/tt\u003e as \u003ctt\u003e\u0026amp;quot;\u003c/tt\u003e, but attribute values never visit that path. A markdown link whose URL or title contains a bare \u003ctt\u003e\"\u003c/tt\u003e closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, \u003ctt\u003e[click](http://example.com/?a=x\" onerror=\"alert(1))\u003c/tt\u003e renders as \u003ctt\u003e\u0026lt;a href=\"http://example.com/?a=x\" onerror=\"alert(1)\"\u0026gt;click\u0026lt;/a\u0026gt;\u003c/tt\u003e, executing arbitrary JavaScript in the victim\u0027s browser.\u003c/p\u003e\u003cp\u003eThe earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.\u003c/p\u003e\u003cp\u003eThis issue affects earmark from 1.4.1 onward.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.\n\n\u0027Elixir.Earmark.Transform\u0027:_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal \" bytes: [\" \", name, \"=\\\"\", value, \"\\\"\"]. Text nodes are routed through the existing escape function which encodes \" as \u0026quot;, but attribute values never visit that path. A markdown link whose URL or title contains a bare \" closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x\" onerror=\"alert(1)) renders as \u003ca href=\"http://example.com/?a=x\" onerror=\"alert(1)\"\u003eclick\u003c/a\u003e, executing arbitrary JavaScript in the victim\u0027s browser.\n\nThe earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.\n\nThis issue affects earmark from 1.4.1 onward."
}
],
"impacts": [
{
"capecId": "CAPEC-243",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-243 XSS Targeting HTML Attributes"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-83",
"description": "CWE-83 Improper Neutralization of Script in Attributes in a Web Page",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T04:45:59.864Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"related",
"third-party-advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48591.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48591"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored XSS via unescaped HTML attribute values in earmark",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMigrate to a maintained Markdown library such as \u003ca href=\"https://hex.pm/packages/mdex\"\u003eMDEx\u003c/a\u003e. The earmark package has been retired on Hex and no patched release will be made.\u003c/p\u003e"
}
],
"value": "Migrate to a maintained Markdown library such as MDEx (https://hex.pm/packages/mdex). The earmark package has been retired on Hex and no patched release will be made."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-48591",
"datePublished": "2026-06-17T16:42:37.508Z",
"dateReserved": "2026-05-22T09:36:56.834Z",
"dateUpdated": "2026-06-18T04:45:59.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}