mo has a XSS via inline SVG script tags in Markdown rendering

Summary

When rendering Markdown files containing inline SVG elements with <script> tags, the embedded JavaScript is executed in the browser. This is due to rehype-raw passing raw HTML (including SVG) through to the DOM without sanitization.

PoC

<svg><script>alert(1)</script></svg>

Embedding the above in a Markdown file opened with mo causes the script to execute.

Impact

Arbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents.

Remediation

Fixed by adding rehype-sanitize to the Markdown rendering pipeline, which strips dangerous elements such as <script> while preserving safe HTML.