CVE-2026-48591

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48591", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-05-22T09:36:56.834Z", "datePublished": "2026-06-17T16:42:37.508Z", "dateUpdated": "2026-06-18T04:45:59.864Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Earmark.Transform'"], "packageName": "earmark", "packageURL": "pkg:hex/earmark", "product": "earmark", "programFiles": ["lib/earmark/transform.ex"], "programRoutines": [{"name": "'Elixir.Earmark.Transform':_make_att1/2"}], "repo": "https://github.com/pragdave/earmark", "vendor": "pragdave", "versions": [{"lessThan": "*", "status": "affected", "version": "1.4.1", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Earmark.Transform'"], "packageName": "pragdave/earmark", "packageURL": "pkg:github/pragdave/earmark", "product": "earmark", "programFiles": ["lib/earmark/transform.ex"], "programRoutines": [{"name": "'Elixir.Earmark.Transform':_make_att1/2"}], "repo": "https://github.com/pragdave/earmark", "vendor": "pragdave", "versions": [{"lessThan": "*", "status": "affected", "version": "8236a0570bd894b50e360da08131ec3294c20799", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Robert Dober"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.</p><p><tt>'Elixir.Earmark.Transform':_make_att1/2</tt> in <tt>lib/earmark/transform.ex</tt> splices attribute values verbatim between two literal <tt>\"</tt> bytes: <tt>[\" \", name, \"=\\\"\" , value, \"\\\"\"]</tt>. Text nodes are routed through the existing escape function which encodes <tt>\"</tt> as <tt>&amp;quot;</tt>, but attribute values never visit that path. A markdown link whose URL or title contains a bare <tt>\"</tt> closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, <tt>[click](http://example.com/?a=x\" onerror=\"alert(1))</tt> renders as <tt>&lt;a href=\"http://example.com/?a=x\" onerror=\"alert(1)\"&gt;click&lt;/a&gt;</tt>, executing arbitrary JavaScript in the victim's browser.</p><p>The earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.</p><p>This issue affects earmark from 1.4.1 onward.</p>"}], "value": "Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.\n\n'Elixir.Earmark.Transform':_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal \" bytes: [\" \", name, \"=\\\"\", value, \"\\\"\"]. Text nodes are routed through the existing escape function which encodes \" as &quot;, but attribute values never visit that path. A markdown link whose URL or title contains a bare \" closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x\" onerror=\"alert(1)) renders as <a href=\"http://example.com/?a=x\" onerror=\"alert(1)\">click</a>, executing arbitrary JavaScript in the victim's browser.\n\nThe earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.\n\nThis issue affects earmark from 1.4.1 onward."}], "impacts": [{"capecId": "CAPEC-243", "descriptions": [{"lang": "en", "value": "CAPEC-243 XSS Targeting HTML Attributes"}]}], "metrics": [{"cvssV4_0": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 4.8, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-83", "description": "CWE-83 Improper Neutralization of Script in Attributes in a Web Page", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-06-18T04:45:59.864Z"}, "references": [{"tags": ["related", "third-party-advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-48591.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48591"}], "source": {"discovery": "EXTERNAL"}, "title": "Stored XSS via unescaped HTML attribute values in earmark", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Migrate to a maintained Markdown library such as <a href=\"https://hex.pm/packages/mdex\">MDEx</a>. The earmark package has been retired on Hex and no patched release will be made.</p>"}], "value": "Migrate to a maintained Markdown library such as MDEx (https://hex.pm/packages/mdex). The earmark package has been retired on Hex and no patched release will be made."}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-17T18:25:40.841347Z", "id": "CVE-2026-48591", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T18:25:55.606Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48591", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-17T18:25:40.841347Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T18:25:50.701Z"}}], "cna": {"title": "Stored XSS via unescaped HTML attribute values in earmark", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Robert Dober"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "impacts": [{"capecId": "CAPEC-243", "descriptions": [{"lang": "en", "value": "CAPEC-243 XSS Targeting HTML Attributes"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 4.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"], "repo": "https://github.com/pragdave/earmark", "vendor": "pragdave", "modules": ["'Elixir.Earmark.Transform'"], "product": "earmark", "versions": [{"status": "affected", "version": "1.4.1", "lessThan": "*", "versionType": "semver"}], "packageURL": "pkg:hex/earmark", "packageName": "earmark", "programFiles": ["lib/earmark/transform.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Earmark.Transform':_make_att1/2"}]}, {"cpes": ["cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"], "repo": "https://github.com/pragdave/earmark", "vendor": "pragdave", "modules": ["'Elixir.Earmark.Transform'"], "product": "earmark", "versions": [{"status": "affected", "version": "8236a0570bd894b50e360da08131ec3294c20799", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/pragdave/earmark", "packageName": "pragdave/earmark", "programFiles": ["lib/earmark/transform.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Earmark.Transform':_make_att1/2"}]}], "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-48591.html", "tags": ["related", "third-party-advisory"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48591", "tags": ["related"]}], "workarounds": [{"lang": "en", "value": "Migrate to a maintained Markdown library such as MDEx (https://hex.pm/packages/mdex). The earmark package has been retired on Hex and no patched release will be made.", "supportingMedia": [{"type": "text/html", "value": "<p>Migrate to a maintained Markdown library such as <a href=\"https://hex.pm/packages/mdex\">MDEx</a>. The earmark package has been retired on Hex and no patched release will be made.</p>", "base64": false}]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.\n\n'Elixir.Earmark.Transform':_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal \" bytes: [\" \", name, \"=\\\"\", value, \"\\\"\"]. Text nodes are routed through the existing escape function which encodes \" as &quot;, but attribute values never visit that path. A markdown link whose URL or title contains a bare \" closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x\" onerror=\"alert(1)) renders as <a href=\"http://example.com/?a=x\" onerror=\"alert(1)\">click</a>, executing arbitrary JavaScript in the victim's browser.\n\nThe earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.\n\nThis issue affects earmark from 1.4.1 onward.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.</p><p><tt>'Elixir.Earmark.Transform':_make_att1/2</tt> in <tt>lib/earmark/transform.ex</tt> splices attribute values verbatim between two literal <tt>\"</tt> bytes: <tt>[\" \", name, \"=\\\"\" , value, \"\\\"\"]</tt>. Text nodes are routed through the existing escape function which encodes <tt>\"</tt> as <tt>&amp;quot;</tt>, but attribute values never visit that path. A markdown link whose URL or title contains a bare <tt>\"</tt> closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, <tt>[click](http://example.com/?a=x\" onerror=\"alert(1))</tt> renders as <tt>&lt;a href=\"http://example.com/?a=x\" onerror=\"alert(1)\"&gt;click&lt;/a&gt;</tt>, executing arbitrary JavaScript in the victim's browser.</p><p>The earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.</p><p>This issue affects earmark from 1.4.1 onward.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-83", "description": "CWE-83 Improper Neutralization of Script in Attributes in a Web Page"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "1.4.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-06-18T04:45:59.864Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48591", "state": "PUBLISHED", "dateUpdated": "2026-06-18T04:45:59.864Z", "dateReserved": "2026-05-22T09:36:56.834Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-06-17T16:42:37.508Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Earmark.Transform'"], "packageName": "earmark", "packageURL": "pkg:hex/earmark", "product": "earmark", "programFiles": ["lib/earmark/transform.ex"], "programRoutines": [{"name": "'Elixir.Earmark.Transform':_make_att1/2"}], "repo": "https://github.com/pragdave/earmark", "vendor": "pragdave", "versions": [{"lessThan": "*", "status": "affected", "version": "1.4.1", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:pragdave:earmark:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Earmark.Transform'"], "packageName": "pragdave/earmark", "packageURL": "pkg:github/pragdave/earmark", "product": "earmark", "programFiles": ["lib/earmark/transform.ex"], "programRoutines": [{"name": "'Elixir.Earmark.Transform':_make_att1/2"}], "repo": "https://github.com/pragdave/earmark", "vendor": "pragdave", "versions": [{"lessThan": "*", "status": "affected", "version": "8236a0570bd894b50e360da08131ec3294c20799", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.\n\n'Elixir.Earmark.Transform':_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal \" bytes: [\" \", name, \"=\\\"\", value, \"\\\"\"]. Text nodes are routed through the existing escape function which encodes \" as &quot;, but attribute values never visit that path. A markdown link whose URL or title contains a bare \" closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x\" onerror=\"alert(1)) renders as <a href=\"http://example.com/?a=x\" onerror=\"alert(1)\">click</a>, executing arbitrary JavaScript in the victim's browser.\n\nThe earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.\n\nThis issue affects earmark from 1.4.1 onward."}, {"lang": "es", "value": "Vulnerabilidad de neutralizaci\u00f3n incorrecta de script en atributos en una p\u00e1gina web en pragdave earmark permite cross-site scripting almacenado a trav\u00e9s de valores de atributos HTML sin escapar.\n\n\u2019Elixir.Earmark.Transform\u2019:_make_att1/2 en lib/earmark/transform.ex empalma valores de atributos textualmente entre dos bytes literales \u201c: [\u201d \u201c, name, \u201d=\\\u201c\u201d, value, \u201c\\\u201d\u201c]. Los nodos de texto se enrutan a trav\u00e9s de la funci\u00f3n de escape existente que codifica \u201d como \u201c, pero los valores de los atributos nunca pasan por esa ruta. Un enlace de markdown cuya URL o t\u00edtulo contiene un \u201d desnudo cierra el atributo prematuramente y permite que los bytes restantes sean analizados por el navegador como nuevos atributos HTML. Por ejemplo, [click](http://example.com/?a=x\u201c onerror_disabled=\u201dalert(1)) se renderiza como <a href=\u201chttp://example.com/?a=x\u201d onerror_disabled=\u201calert(1)\u201d>click[/a], ejecutando JavaScript arbitrario en el navegador de la v\u00edctima.\n\nLa biblioteca earmark ya no se mantiene y ha sido retirada de Hex. Ninguna versi\u00f3n parcheada ser\u00e1 lanzada. Todas las versiones desde la 1.4.1 en adelante est\u00e1n afectadas, y los usuarios deber\u00edan migrar a una biblioteca de Markdown mantenida como MDEx.\n\nEste problema afecta a earmark desde la 1.4.1 en adelante."}], "id": "CVE-2026-48591", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48591", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-17T18:25:40.841347Z", "version": "2.0.3"}}]}, "published": "2026-06-17T18:18:04.370", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-48591.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48591"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-83"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.4.1,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "earmark", "source": "cna", "vendor": "pragdave"}, "product": "earmark", "vendor": "pragdave"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8236a0570bd894b50e360da08131ec3294c20799,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "earmark", "source": "cna", "vendor": "pragdave"}, "product": "earmark", "vendor": "pragdave"}], "created": "2026-06-18T19:30:15.426164+00:00", "updated": "2026-06-18T20:30:05.128928+00:00", "vendors": ["pragdave", "pragdave$PRODUCT$earmark"]}