Skip to content
Fencer Intel
low —

GHSA-vccx-p757-pv6h json

mo has a XSS via inline SVG script tags in Markdown rendering

published 7mo ago modified 7mo ago also GO-2026-4765

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Summary

When rendering Markdown files containing inline SVG elements with `<script>` tags, the embedded JavaScript is executed in the browser. This is due to `rehype-raw` passing raw HTML (including SVG) through to the DOM without sanitization.

### PoC

```html <svg><script>alert(1)</script></svg> ```

Embedding the above in a Markdown file opened with mo causes the script to execute.

### Impact

Arbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents.

### Remediation

Fixed by adding `rehype-sanitize` to the Markdown rendering pipeline, which strips dangerous elements such as `<script>` while preserving safe HTML.

Patch / fix

  • go github.com/k1LoW/mo 0.18.5

Is GHSA-vccx-p757-pv6h in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
go github.com/k1LoW/mo
<0.18.5
0.18.5

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.