The vulnerability occurs because md‑editor‑v3 does not escape or quote fenced‑code language values that are inserted into the class and language attributes of rendered HTML. Both highlighted and non‑highlighted rendering paths produce this unsanitized attribute content. XSSPlugin only filters existing html_block and html_inline tokens and cannot inspect the renderer‑generated HTML, so the attack vector is not mitigated by that plugin. An attacker who can supply Markdown is able to embed crafted fenced‑code syntax that results in JavaScript execution when the content is rendered, providing a stored cross‑site scripting (XSS) vector for the application origin.

The affected product is imzbf md‑editor‑v3. All releases prior to version 6.5.4 are susceptible; the fix was introduced in v6.5.4 and later. Any deployment that renders user‑supplied Markdown is potentially impacted.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in KEV, so the exact exploitation probability is uncertain. The likely attack vector is any application allowing users to create or store Markdown content, such as a CMS, forum, or note‑taking application, where the forged fenced‑code block can be persisted and later rendered. Because the flaw allows code execution within the page context, an attacker can hijack the victim’s session, steal credentials, deface content, or perform other malicious actions. Mitigation depends on applying the vendor‑supplied fix; other defensive measures provide incomplete coverage for this specific injection point.