{"id":"GHSA-vccx-p757-pv6h","aliases":["GO-2026-4765"],"status":"published","title":"mo has a XSS via inline SVG script tags in Markdown rendering","description":"### Summary\n\nWhen rendering Markdown files containing inline SVG elements with `\u003cscript\u003e` tags, the embedded JavaScript is executed in the browser. This is due to `rehype-raw` passing raw HTML (including SVG) through to the DOM without sanitization.\n\n### PoC\n\n```html\n\u003csvg\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003c/svg\u003e\n```\n\nEmbedding the above in a Markdown file opened with mo causes the script to execute.\n\n### Impact\n\nArbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents.\n\n### Remediation\n\nFixed by adding `rehype-sanitize` to the Markdown rendering pipeline, which strips dangerous elements such as `\u003cscript\u003e` while preserving safe HTML.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-03-18T20:17:12Z","modified":"2026-03-23T18:56:25Z","fixes":[{"ecosystem":"Go","package":"github.com/k1LoW/mo","fixed_in":["0.18.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/k1LoW/mo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.18.4"},{"fixed":"0.18.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/k1LoW/mo","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.18.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/k1LoW/mo","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.18.5"}]}]}],"references":[{"url":"https://github.com/k1LoW/mo/security/advisories/GHSA-vccx-p757-pv6h","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-vccx-p757-pv6h"},{"url":"https://github.com/k1LoW/mo","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-vccx-p757-pv6h","title":"mo has a XSS via inline SVG script tags in Markdown rendering","description":"### Summary\n\nWhen rendering Markdown files containing inline SVG elements with `\u003cscript\u003e` tags, the embedded JavaScript is executed in the browser. This is due to `rehype-raw` passing raw HTML (including SVG) through to the DOM without sanitization.\n\n### PoC\n\n```html\n\u003csvg\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003c/svg\u003e\n```\n\nEmbedding the above in a Markdown file opened with mo causes the script to execute.\n\n### Impact\n\nArbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents.\n\n### Remediation\n\nFixed by adding `rehype-sanitize` to the Markdown rendering pipeline, which strips dangerous elements such as `\u003cscript\u003e` while preserving safe HTML.","status":"published","published":"2026-03-18T20:17:12Z","modified":"2026-03-18T20:17:12Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:37.554665Z"}],"osv":[{"id":"GHSA-vccx-p757-pv6h","title":"mo has a XSS via inline SVG script tags in Markdown rendering","description":"### Summary\n\nWhen rendering Markdown files containing inline SVG elements with `\u003cscript\u003e` tags, the embedded JavaScript is executed in the browser. This is due to `rehype-raw` passing raw HTML (including SVG) through to the DOM without sanitization.\n\n### PoC\n\n```html\n\u003csvg\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003c/svg\u003e\n```\n\nEmbedding the above in a Markdown file opened with mo causes the script to execute.\n\n### Impact\n\nArbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents.\n\n### Remediation\n\nFixed by adding `rehype-sanitize` to the Markdown rendering pipeline, which strips dangerous elements such as `\u003cscript\u003e` while preserving safe HTML.","status":"published","published":"2026-03-18T20:17:12Z","modified":"2026-03-23T18:56:25.781957Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"GO-2026-4765","title":"mo has a XSS via inline SVG script tags in Markdown rendering in github.com/k1LoW/mo","description":"mo has a XSS via inline SVG script tags in Markdown rendering in github.com/k1LoW/mo","status":"published","published":"2026-03-23T18:14:51Z","modified":"2026-03-23T18:45:18.870859Z","updated_at":"2026-11-02T15:47:02.280725Z"}]}}