mo has a XSS via inline SVG script tags in Markdown rendering
Date: 2026-03
Affected: go/github.com/k1LoW/mo
Attack vector: xss
Category: vulnerability-disclosure
Severity: Low
CWE: CWE-79

### Summary When rendering Markdown files containing inline SVG elements with `<script>` tags, the embedded JavaScript is executed in the browser. This is due to `rehype-raw` passing raw HTML (including SVG) through to the DOM without sanitization. ### PoC ```html <svg><script>alert(1)</script></svg> ``` Embedding the above in a Markdown file opened with mo causes the script to execute. ### Impact Arbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents. ### Remediation Fixed by adding `rehype-sanitize` to the Markdown rendering pipeline, which strips dangerous elements such as `<script>` while preserving safe HTML.


Mitigations:

Architectural layers (MAESTRO):