md-editor-v3: XSS via fenced-code language rendering bypass
MdPreview interpolates a fenced-code language into HTML attributes without escaping it. A crafted info string therefore executes JavaScript even when the shipped XSSPlugin is enabled.
Advisories for Npm/Md-Editor-V3 package
2026