Migrate off earmark: retired, unmaintained, and its XSS advisory has no fix #14

New issue

Open

opened 2026-09-02 09:43:06 +00:00 by jlxq0 · 0 comments

jlxq0 commented

2026-09-02 09:43:06 +00:00

Owner

earmark is retired on Hex and unmaintained, and its Stored-XSS advisory has no fixed version, so it cannot be bumped and the only remedy is migrating off it.

What the instrument says

mix deps.get on main:

earmark 1.4.49 RETIRED! VULNERABLE!
  EEF-CVE-2026-48591 (MEDIUM) — Stored XSS via unescaped HTML attribute values
  (deprecated) Earmark is no longer maintained. Migrate to a replacement, for example MDEx.

No fixed version exists. OSV lists introduced: 1.4.1 and no fixed event, so no earmark release closes the CVE.
1.4.49 is the latest non-pre release and it is retired; mix deps.update earmark cannot move within ~> 1.4. The only newer things on Hex are 1.5.0-pre pre-releases of an abandoned package.

Why it is not urgent, and why it is still worth doing

earmark is used at exactly one call site, lib/eltrix_site/policies.ex:51, rendering the operator-authored policy markdown in priv/policies/*.md. No user input reaches it, so the Stored-XSS-via-attribute-values path is not attacker-reachable here.

RETIRED is the reason to move, independent of the CVE. Hex pulled the version and the package is deprecated, which is a supply-chain fact rather than a severity judgement. Somebody reading MEDIUM later would conclude the wrong thing about why this moves.

The work

Migrate policies.ex from Earmark.as_html!/2 to a maintained parser (MDEx is Hex's suggested replacement), swap the dependency in mix.exs, and confirm the rendered policy pages are byte-equivalent or reviewed for the differences. Then mix deps.get no longer reports a retired dependency.

Found while bumping bandit for jlxq0/mantis#324; recorded there with the reachability.

`earmark` is retired on Hex and unmaintained, and its Stored-XSS advisory has no fixed version, so it cannot be bumped and the only remedy is migrating off it. ## What the instrument says `mix deps.get` on `main`: ``` earmark 1.4.49 RETIRED! VULNERABLE! EEF-CVE-2026-48591 (MEDIUM) — Stored XSS via unescaped HTML attribute values (deprecated) Earmark is no longer maintained. Migrate to a replacement, for example MDEx. ``` - **No fixed version exists.** OSV lists `introduced: 1.4.1` and no `fixed` event, so no earmark release closes the CVE. - 1.4.49 is the latest non-pre release and it is **retired**; `mix deps.update earmark` cannot move within `~> 1.4`. The only newer things on Hex are `1.5.0-pre` pre-releases of an abandoned package. ## Why it is not urgent, and why it is still worth doing `earmark` is used at exactly one call site, `lib/eltrix_site/policies.ex:51`, rendering the operator-authored policy markdown in `priv/policies/*.md`. No user input reaches it, so the Stored-XSS-via-attribute-values path is not attacker-reachable here. **RETIRED is the reason to move, independent of the CVE.** Hex pulled the version and the package is deprecated, which is a supply-chain fact rather than a severity judgement. Somebody reading *MEDIUM* later would conclude the wrong thing about why this moves. ## The work Migrate `policies.ex` from `Earmark.as_html!/2` to a maintained parser (MDEx is Hex's suggested replacement), swap the dependency in `mix.exs`, and confirm the rendered policy pages are byte-equivalent or reviewed for the differences. Then `mix deps.get` no longer reports a retired dependency. Found while bumping bandit for `jlxq0/mantis#324`; recorded there with the reachability.