DOM XSS in Milkdown Emoji Plugin via Unsanitized Paste Content

Executive Summary

Milkdown before version 7.21.3 has a DOM-based cross-site scripting (XSS) vulnerability in the @milkdown/plugin-emoji package. Attackers can exploit this by tricking a user into pasting malicious content. The vulnerability occurs because the raw innerHTML of pasted span elements with data-type='emoji' is stored without sanitization. When markdown is serialized, this unsanitized value is assigned directly to a live DOM element's innerHTML, bypassing DOMPurify sanitization and executing the payload.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect your Milkdown installations for versions before 7.21.3. Check for the presence of the @milkdown/plugin-emoji package and verify if the parseDOM.getAttrs handler stores raw innerHTML without sanitization. Review markdown serialization processes for unsanitized DOM assignments.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin. If you use Milkdown versions before 7.21.3 and paste content from untrusted sources, attackers could steal sensitive data, perform actions on your behalf, or compromise your session.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized execution of JavaScript in the host application's origin. This may lead to data breaches, unauthorized access to sensitive information, or manipulation of user data, which are critical concerns under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Milkdown to version 7.21.3 or later. Remove or disable the @milkdown/plugin-emoji package if not required. Implement additional input sanitization for pasted content, ensuring all DOM assignments are properly sanitized before rendering.

Useful 0 Not Useful 0