Listen to this Post
The vulnerability in mdast-util-to-hast arises from improper sanitization of class attributes when processing markdown input. Specifically, when markdown source contains character references for classnames, the library fails to prefix or sanitize these classnames before converting them to HTML. This allows an attacker to inject arbitrary class attributes into rendered code elements. For example, using markdown like `` (with character references for ‘xss’) results in HTML output <pre><code></code></pre>. If the webpage has CSS rules or JavaScript event listeners attached to the ‘.xss’ class, the attacker can manipulate the appearance or behavior of the rendered content. This cross-site scripting (XSS) vector exploits the trust placed in markdown rendering, potentially leading to style injection or script execution depending on how classes are used in the target application. The issue affects versions prior to 13.2.1, where class attribute handling did not enforce sanitization against user-supplied markdown.
Platform: mdast-util-to-hast
Version: before 13.2.1
Vulnerability: unsanitized class attribute
Severity: moderate
date: Dec 1, 2025
Prediction: Patched Dec 2, 2025
What Undercode Say:
Analytics:
npm install [email protected]
<pre><code></code></pre>
How Exploit:
Inject character references in markdown class attributes to match existing CSS/JS selectors, enabling style or script manipulation.
Protection from this CVE
Update to version 13.2.1.
Impact:
Potential XSS via class attribute injection affecting rendered markdown elements.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
