pragdave earmark up to 1.4.1 lib/earmark/transform.ex cross site scripting

Summaryinfo

A vulnerability marked as problematic has been reported in pragdave earmark up to 1.4.1. The affected element is an unknown function in the library lib/earmark/transform.ex. This manipulation causes cross site scripting. This vulnerability appears as CVE-2026-48591. The attack requires local access. There is no available exploit.

Detailsinfo

A vulnerability was found in pragdave earmark up to 1.4.1. It has been declared as problematic. Affected by this vulnerability is an unknown code in the library lib/earmark/transform.ex. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-83. The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values. 'Elixir.Earmark.Transform':_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: [" ", name, "=\"", value, "\""]. Text nodes are routed through the existing escape function which encodes " as ", but attribute values never visit that path. A markdown link whose URL or title contains a bare " closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x" onerror="alert(1)) renders as click, executing arbitrary JavaScript in the victim's browser. The earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx. This issue affects earmark from 1.4.1 onward.

The weakness was presented by Peter Ullrich and Jonatan Männchen. It is possible to read the advisory at cna.erlef.org. This vulnerability is known as CVE-2026-48591 since 05/22/2026. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• pragdave

Name

• earmark

Version

• 1.4.0
• 1.4.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion