What is CVE-2026-57531?
CVE-2026-57531 is a DOM-based Cross-Site Scripting vulnerability in the @milkdown/plugin-emoji package. It allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by tricking a victim into pasting attacker-controlled content, affecting Milkdown versions before 7.21.3. Users must update to version 7.21.3 or later immediately.
Azərbaycanca: CVE-2026-57531, @milkdown/plugin-emoji paketində aşkarlanmış DOM əsaslı XSS zəifliyidir. Bu zəiflik autentifikasiya olunmamış hücumçuya, istifadəçinin zərərli məzmunu yapışdırması nəticəsində host tətbiqin kontekstində ixtiyari JavaScript kodunu icra etməyə imkan verir. 7.21.3 versiyasından əvvəlki Milkdown istifadəçiləri dərhal yeniləmə etməlidir.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
In which package was CVE-2026-57531 discovered?
CVE-2026-57531 is a DOM-based XSS vulnerability discovered in the @milkdown/plugin-emoji package.
What should users do to protect against this vulnerability?
Milkdown users running versions before 7.21.3 must update to version 7.21.3 or later immediately.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.