GHSA-vccx-p757-pv6h
mo has a XSS via inline SVG script tags in Markdown rendering
Summary
When rendering Markdown files containing inline SVG elements with <script> tags, the embedded JavaScript is executed in the browser. This is due to rehype-raw passing raw HTML (including SVG) through to the DOM without sanitization.
PoC
<svg><script>alert(1)</script></svg>
Embedding the above in a Markdown file opened with mo causes the script to execute.
Impact
Arbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents.
Remediation
Fixed by adding rehype-sanitize to the Markdown rendering pipeline, which strips dangerous elements such as <script> while preserving safe HTML.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
mo has a XSS via inline SVG script tags in Markdown rendering
Summary
When rendering Markdown files containing inline SVG elements with <script> tags, the embedded JavaScript is executed in the browser. This is due to rehype-raw passing raw HTML (including SVG) through to the DOM without sanitization.
PoC
<svg><script>alert(1)</script></svg>
Embedding the above in a Markdown file opened with mo causes the script to execute.
Impact
Arbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents.
Remediation
Fixed by adding rehype-sanitize to the Markdown rendering pipeline, which strips dangerous elements such as <script> while preserving safe HTML.
- Record
GHSA-vccx-p757-pv6h- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
mo has a XSS via inline SVG script tags in Markdown rendering
Summary
When rendering Markdown files containing inline SVG elements with <script> tags, the embedded JavaScript is executed in the browser. This is due to rehype-raw passing raw HTML (including SVG) through to the DOM without sanitization.
PoC
<svg><script>alert(1)</script></svg>
Embedding the above in a Markdown file opened with mo causes the script to execute.
Impact
Arbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents.
Remediation
Fixed by adding rehype-sanitize to the Markdown rendering pipeline, which strips dangerous elements such as <script> while preserving safe HTML.
- Record
GHSA-vccx-p757-pv6h- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGO-2026-4765No score
mo has a XSS via inline SVG script tags in Markdown rendering in github.com/k1LoW/mo
mo has a XSS via inline SVG script tags in Markdown rendering in github.com/k1LoW/mo
- Record
GO-2026-4765- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/k1LoW/moGo | through 0.18.4 | 0.18.5 |
github.com/k1LoW/moGo | before 0.18.5 | 0.18.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-vccx-p757-pv6h is a low vulnerability (CVSS 2.3) in github.com/k1LoW/mo, published March 18, 2026. No source lists public exploit code. Fixed in github.com/k1LoW/mo 0.18.5.