The earmark Markdown parser for Elixir contains a stored cross‑site scripting flaw that arises when the library inserts attribute values directly into HTML tags without escaping quotation marks. A crafted Markdown link whose URL or title contains an unescaped quote followed by a JavaScript event handler causes the generated HTML element to include a new attribute. When a browser renders this output, the injected script runs in the user’s context, allowing the attacker to steal session cookies, deface content, or perform other malicious actions.

The vulnerability affects the earmark library released by the original author pragdave, with all versions from 1.4.1 upward being susceptible. Any Elixir application that incorporates earmark 1.4.1 or later to render user‑supplied Markdown is at risk.

The CVSS score of 4.8 denotes a moderate impact, and the EPSS value of less than 1% indicates a very small current exploitation probability. The vulnerability does not appear in CISA’s KEV catalog. Exploitation requires an attacker to inject a specially crafted Markdown link that contains an unescaped quotation mark and an event attribute, which must be stored and later rendered by a web application. If the application exposes this rendered content to the browser, the injected JavaScript executes in the victim’s session.