Milkdown before version 7.21.3 contains a stored cross‑site scripting flaw in the @milkdown/preset-commonmark and @milkdown/components packages. An attacker who can write to a document can embed a link whose href contains a javascript: URL. During parsing, the URL is stored as a raw href attribute without scheme validation, and the DOMPurify.sanitize call fails to treat it as an anchor element, so the javascript: payload is preserved. When another user opens the document or clicks the rendered link, the JavaScript runs in that user’s browser context, allowing arbitrary client‑side code to execute.

All releases of Milkdown prior to 7.21.3 that include the vulnerable @milkdown/preset-commonmark and @milkdown/components packages. Any deployment that has not upgraded to v7.21.3 or later is susceptible regardless of the hosting environment, provided an attacker has permission to write to the document.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score of less than 1% and the absence from the CISA KEV catalog imply a low likelihood of widespread exploitation at this time. The vulnerability requires an attacker to have document‑write access to inject the malicious link and then rely on another user to open the document or click the link; once that occurs the stored payload executes in the victim’s browser. Because no network‑level or elevated privileges are required beyond document write rights, the overall risk remains moderate.