k1LoW vulnerabilities

Products

• github.com/k1LoW/mo 1

Latest k1LoW CVEs

Newest publication first

1. GHSA-vccx-p757-pv6h mo has a XSS via inline SVG script tags in Markdown rendering

   Published 2026-03-18

   Low·CVSS 2.3

   Summary When rendering Markdown files containing inline SVG elements with <script> tags, the embedded JavaScript is executed in the browser. This is due to rehype-raw passing raw HTML (including SVG) through to the DOM without sanitization. PoC <svg><script>alert(1)</script></svg...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.