When rendering Markdown files containing inline SVG elements with <script> tags, the embedded JavaScript is executed in the browser. This is due to rehype-raw passing raw HTML (including SVG) through to the DOM without sanitization.
<svg><script>alert(1)</script></svg>
Embedding the above in a Markdown file opened with mo causes the script to execute.
Arbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents.
Fixed by adding rehype-sanitize to the Markdown rendering pipeline, which strips dangerous elements such as <script> while preserving safe HTML.
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 2.3 | 4.0 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-vccx-p757-pv6h ↗ |
| CWE id | Name |
|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| go | github.com/k1LoW/mo | <= 0.18.4 | 0.18.5 | — |