The vulnerability in the HTML renderer for a popular Markdown processing library permits cross‑site scripting. The flaw arises because URL validation is performed before HTML entity resolution, allowing an attacker to encode a dangerous scheme with named character references. A payload such as "javascript:alert(1)" bypasses the protocol check, causing script execution in any application that renders the URL. This flaw confers the ability to run client‑side code in the user’s context, impacting confidentiality, integrity, and availability of the affected web application.

Affected products include the Go library for Markdown rendering maintained by the entity at github.com/yuin/goldmark under the renderer/html module. Versions prior to 1.7.17 are susceptible. No other vendors or product versions are listed.

The CVSS score of 5.1 places this issue in the medium severity range, and the EPSS score is not available, making the likelihood of exploitation uncertain. The vulnerability is not listed in the CISA KEV catalog, which suggests it has not been widely exploited in the wild at the time of analysis. Existing exploitation would require the target application to render attacker‑controlled Markdown that contains malicious URLs. The attack vector is attacker‑controlled content, typically via user input or content management systems that fail to sanitize Markdown before rendering.