GHSA-vccx-p757-pv6h mo has a XSS via inline SVG script tags in Markdown rendering

• Go github.com/k1LoW/mo: < 0.18.5 → fixed in 0.18.5

Summary When rendering Markdown files containing inline SVG elements with `` tags, the embedded JavaScript is executed in the browser. This is due to `rehype-raw` passing raw HTML (including SVG) through to the DOM without sanitization. PoC ```html alert(1) ``` Embedding the above in a Markdown file opened with mo causes the script to execute. Impact Arbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents. Remediation Fixed by adding `rehype-sanitize` to the Markdown rendering pipeline, which strips dangerous elements such as `` while preserving safe HTML.