CVE-2026-66921

This vulnerability lives in the node-reference tokenizer for graph or note rendering. The tokenizer was written to block square brackets — a Markdown metacharacter used in link syntax — because the original developers were concerned with Markdown correctness, not HTML injection. Square brackets passed through unescaped because they meant nothing to HTML parsers. But quotes, angle brackets, and ampersands — the actual vehicles for HTML injection — were never considered. The result is a latent XSS vector that triggers when rendered by any consumer that doesn't apply DOMPurify or equivalent sanitization. Check your rendering pipeline: if you consume this library and render node-references without an HTML sanitizer in the chain, you're vulnerable. The attack surface is any path where a crafted note or graph file gets rendered on load or access. The patch introduces a shared escaping function, which suggests the original codebase had no centralized HTML-encoding utility — attribute injection risks were likely scattered elsewhere in the stack. The conditional phrasing in the vulnerability ('when a consumer fails to apply DOMPurify') is the critical detail. It reveals an architectural assumption that HTML safety was someone else's responsibility — an implicit contract that downstream consumers may not realize they're bound by. If you're using this library, verify whether your rendering context actually runs sanitization, and don't assume the library's output is safe by default. The presence of a shared escaping function in the patch doesn't make your input safe; it makes the library's output slightly less dangerous, but you're still responsible for your own sanitization layer.

Reviewed through automated stages and approved by a human before publication.