Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values. 'Elixir.Earmark.Transform':_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: [" ", name, "=\"", value, "\""]. Text nodes are routed through the existing escape function which encodes " as ", but attribute values never visit that path. A markdown link whose URL or title contains a bare " closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x" onerror="alert(1)) renders as <a href="http://example.com/?a=x" onerror="alert(1)">click</a>, executing arbitrary JavaScript in the victim's browser. The earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx. This issue affects earmark from 1.4.1 onward.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-17 | 2 | Disclosure2 |
| 2026-06-18 | 1 | General1 |
CVE-2026-48591 Stored Cross-Site Scripting via Unescaped HTML Attributes in Pragdave Earmark https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48591
Post summary
The text announces CVE‑2026‑48591 as a stored XSS vulnerability in Pragdave Earmark, but provides no further detail on exploits, patches, or operational use.
🚨*CVE* CVE-2026-48591 Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values… https://www.cve.org/CVERecord?id=CVE-2026-48591 ----- Traducción: CVE-2026-48591 Neu… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑48591, gives a concise technical description of a stored XSS flaw, and links to the CVE record, but provides no PoC, exploit, or patch information.
CVE-2026-48591 Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values… https://www.cve.org/CVERecord?id=CVE-2026-48591
Post summary
The text announces CVE‑2026‑48591, describing it as a stored XSS flaw in pragdave earmark caused by unescaped HTML attributes, with no additional PoC, exploit, or mitigation information.