CVE-2025-51691 — Cross-Site Scripting (XSS) vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 (May 2025) allows a remote attacker to execute arbitrary code via a crafted script input to the editor interface

Back Back to CVE browser

MEDIUM

Cross-Site Scripting (XSS) vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 (May 2025) allows a remote attacker to execute arbitrary code via a crafted script input to the editor interface

Published Aug 13, 2025

6.1

MEDIUM

CVSS 3.1

EPSS 0.40%

Description

Cross-Site Scripting (XSS) vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 (May 2025) allows a remote attacker to execute arbitrary code via a crafted script input to the editor interface. The application does not properly sanitize user-supplied Markdown before rendering it. Successful exploitation could lead to session hijacking, credential theft, or arbitrary client-side code execution in the context of the victim's browser.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.40% 0.00396

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00396

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.40% (0.00396)	31.49th	v5 (v2026.06.15)
Jun 15, 2026	0.37% (0.00370)	28.53th	v5 (v2026.06.15)
Aug 14, 2025	0.04% (0.00045)	13.08th	v4 (v2025.03.14)

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

Link	Providers	Tags
https://github.com/0x72303074/CVE-Disclosures/tree/main/MarkTwo%20Markdown%20Editor/CVE-2025-51691
https://github.com/anthonygarvan/marktwo
https://marktwo.app/try-it-now