CVE-2026-48591: Earmark Stored XSS via Unescaped HTML Attribute Values
Summary
CVE-2026-48591: Stored XSS via unescaped HTML attribute values in earmark. Affects earmark across 2 version ranges.
>= 1.4.1
>= 8236a0570bd894b50e360da08131ec3294c20799
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Earmark is a Markdown parser for Elixir, designed to convert Markdown text into HTML. It is widely used in Elixir applications for rendering Markdown content. However, the library has been retired and is no longer maintained, making it vulnerable to various security issues, including the one described here.
Vulnerability Detail
The vulnerability arises from improper neutralization of script in attributes within web pages. Specifically, the function '_make_att1/2' in the Earmark library fails to escape HTML attribute values correctly. This oversight allows attackers to inject malicious JavaScript through unescaped attribute values in Markdown links. For instance, a Markdown link like '[click](http://example.com/?a=x" onerror="alert(1))' can lead to the execution of arbitrary JavaScript in the victim's browser, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Migrate to a maintained Markdown library such as MDEx. The earmark package has been retired on Hex, and no patched release will be made. You can find MDEx at https://hex.pm/packages/mdex.
Conclusion
CVE-2026-48591 highlights a critical stored XSS vulnerability in the Earmark library due to improper handling of HTML attribute values. With no patches available, it is crucial for users to migrate to a maintained Markdown library like MDEx to ensure the security of their applications.
See every vulnerability recorded for earmark →
FAQ
CVE-2026-48591 is a vulnerability in the Earmark library that allows for stored cross-site scripting (XSS) via unescaped HTML attribute values.
If your application uses Earmark to parse Markdown, it may be susceptible to XSS attacks, allowing attackers to execute arbitrary JavaScript in users' browsers.
No, Earmark has been retired and no patched version will be released. Users should migrate to a different library.
It is recommended to migrate to MDEx, a maintained Markdown library that does not have this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
