Milkdown versions earlier than 7.21.3 are vulnerable to a DOM cross‑site scripting flaw in the @milkdown/plugin-emoji module. The module's parseDOM.getAttrs handler stores the raw innerHTML of pasted span elements carrying data‑type="emoji" without sanitization. When the toMarkdown runner later serializes markdown, it assigns this unsanitized innerHTML directly to a live DOM element, bypassing the DOMPurify sanitization normally applied on the toDOM path. The result is that an unauthenticated attacker can cause a victim to paste attacker‑controlled emoji‑containing content, leading to arbitrary JavaScript execution in the host application's origin.

All web applications that integrate the Milkdown editor library together with the @milkdown/plugin-emoji plugin, specifically Milkdown versions before 7.21.3. Any project embedding Milkdown without updating to the patched release is at risk.

The CVSS score of 5.1 indicates a moderate severity, while the EPSS score of less than 1% reflects a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is client‑side and requires a victim to paste content, attackers would most likely use social engineering or malicious clipboard content to trigger the vulnerability. Clients that have not upgraded remain susceptible to payload execution whenever a user pastes emoji content.