CVE-2026-48591: Earmark Stored XSS via Unescaped HTML Attribute Values
Summary
CVE-2026-48591: earmark: Stored XSS via unescaped HTML attribute values. Affects earmark versions >= 1.4.1, <= 1.5.0-pre1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Earmark is a Markdown library for Elixir that converts Markdown text into HTML. It is designed to be simple and efficient, allowing developers to easily integrate Markdown processing into their applications. However, the library has been retired and is no longer maintained, making it vulnerable to various security issues, including the one described here.
Vulnerability Detail
The vulnerability arises from improper neutralization of script in attributes within a web page, specifically in the Earmark library. The function '_make_att1/2' in 'lib/earmark/transform.ex' improperly handles attribute values, splicing them verbatim between literal double quotes. This allows for stored cross-site scripting (XSS) when a Markdown link's URL or title contains unescaped double quotes. For instance, a link formatted as [click](http://example.com/?a=x" onerror="alert(1)) will render as <a href="http://example.com/?a=x" onerror="alert(1)">click</a>, executing arbitrary JavaScript in the victim's browser. This vulnerability affects all versions from 1.4.1 onward.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the best workaround is to avoid using Earmark for rendering untrusted Markdown content. If you must use it, ensure that any user-generated content is sanitized to prevent XSS attacks.
Conclusion
The Earmark library has a serious vulnerability that allows for stored XSS via unescaped HTML attribute values. With no patches available, users must migrate to a different library to ensure the security of their applications. It is crucial to remain vigilant and utilize tools like Vulert for monitoring vulnerabilities.
See every vulnerability recorded for earmark →
FAQ
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
All versions from 1.4.1 onward are affected by this vulnerability.
No, Earmark has been retired and no patched version will be released.
You should migrate to a maintained Markdown library such as MDEx to avoid this vulnerability.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without any signup.
