From 77f0b67f24f0329173e1b0f915c486cb59a8a355 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Thu, 20 Aug 2026 19:47:20 +0200
Subject: [PATCH 01/16] fix(comark): escape attribute values in HTML
 serialization

Attribute values were interpolated into key="value" with no escaping,
so a double quote in any attribute value (raw HTML, component props,
fence info strings, image alt text) terminated the attribute early and
injected attacker-chosen attributes such as onmouseover handlers into
the rendered HTML. This bypassed comark/plugins/security, which
sanitizes the AST but cannot prevent quote breakout at serialization.

- Escape &, ", < and > in all attribute values emitted by
  htmlAttributes()
- Serialize object values as entity-escaped JSON (backslash escaping is
  not valid inside HTML attribute values)
- Drop attribute names outside the safe HTML name charset
- Update SPEC expectations that encoded the broken output
---
 .../SPEC/COMARK/codeblock-multiple-meta.md    |  2 +-
 .../COMARK/component-block-props-types.md     |  2 +-
 .../SPEC/COMARK/component-yaml-props.md       |  2 +-
 .../src/internal/stringify/attributes.ts      | 32 +++++++---
 packages/comark/test/html-escape.test.ts      | 61 +++++++++++++++++++
 5 files changed, 89 insertions(+), 10 deletions(-)
 create mode 100644 packages/comark/test/html-escape.test.ts

diff --git a/packages/comark/SPEC/COMARK/codeblock-multiple-meta.md b/packages/comark/SPEC/COMARK/codeblock-multiple-meta.md
index 4016d5c5..4860adbf 100644
--- a/packages/comark/SPEC/COMARK/codeblock-multiple-meta.md
+++ b/packages/comark/SPEC/COMARK/codeblock-multiple-meta.md
@@ -35,7 +35,7 @@ def greet(name):
 ## HTML
 
 ```html
-<pre language="python" meta="showLineNumbers=true startLine=10 title="Example""><code class="language-python">def greet(name):
+<pre language="python" meta="showLineNumbers=true startLine=10 title=&quot;Example&quot;"><code class="language-python">def greet(name):
     return f"Hello, {name}!"</code></pre>
 ```
 
diff --git a/packages/comark/SPEC/COMARK/component-block-props-types.md b/packages/comark/SPEC/COMARK/component-block-props-types.md
index d445a18c..7345909a 100644
--- a/packages/comark/SPEC/COMARK/component-block-props-types.md
+++ b/packages/comark/SPEC/COMARK/component-block-props-types.md
@@ -50,7 +50,7 @@ Component content
 ## HTML
 
 ```html
-<component title="Hello World" count="42" enabled hidden="false" tags="[\"markdown\",\"docs\"]" config="{\"theme\":\"dark\",\"debug\":false}">
+<component title="Hello World" count="42" enabled hidden="false" tags="[&quot;markdown&quot;,&quot;docs&quot;]" config="{&quot;theme&quot;:&quot;dark&quot;,&quot;debug&quot;:false}">
   Component content
 </component>
 ```
diff --git a/packages/comark/SPEC/COMARK/component-yaml-props.md b/packages/comark/SPEC/COMARK/component-yaml-props.md
index a723bf02..33515be7 100644
--- a/packages/comark/SPEC/COMARK/component-yaml-props.md
+++ b/packages/comark/SPEC/COMARK/component-yaml-props.md
@@ -55,7 +55,7 @@ Second Paragraph
 ## HTML
 
 ```html
-<component attr="value" object-attr="{\"key1\":\"value1\",\"key2\":\"value2\"}" array="[\"item 1\",\"item 2\"]">
+<component attr="value" object-attr="{&quot;key1&quot;:&quot;value1&quot;,&quot;key2&quot;:&quot;value2&quot;}" array="[&quot;item 1&quot;,&quot;item 2&quot;]">
   <p>First Paragraph</p>
   <p>Second Paragraph</p>
 </component>
diff --git a/packages/comark/src/internal/stringify/attributes.ts b/packages/comark/src/internal/stringify/attributes.ts
index adc76c8f..46821c01 100644
--- a/packages/comark/src/internal/stringify/attributes.ts
+++ b/packages/comark/src/internal/stringify/attributes.ts
@@ -183,6 +183,21 @@ export function comarkAttributes(attributes: Record<string, unknown>) {
   return attrs.length > 0 ? `{${attrs}}` : ''
 }
 
+/**
+ * Escape a value for interpolation into a double-quoted HTML attribute.
+ * Prevents attribute breakout (`"` terminating the value early) and markup
+ * injection (`<`/`>` closing the tag), which would otherwise bypass
+ * AST-level sanitization such as `comark/plugins/security`.
+ */
+function escapeHtmlAttribute(value: unknown): string {
+  return String(value).replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+}
+
+// HTML attribute names must start with a letter/underscore/colon and may only
+// contain alphanumerics plus `_ : . -`. Anything else (quotes, spaces, …)
+// could break out of the attribute list, so such keys are dropped entirely.
+const SAFE_ATTR_NAME = /^[a-zA-Z_:][a-zA-Z0-9_:.-]*$/
+
 /**
  * Convert attributes to a string of HTML attributes
  *
@@ -191,17 +206,20 @@ export function comarkAttributes(attributes: Record<string, unknown>) {
  */
 export function htmlAttributes(attributes: Record<string, unknown>) {
   const parts: string[] = []
-  for (const [key, value] of Object.entries(attributes)) {
-    if (key.startsWith(':')) {
+  for (const [rawKey, value] of Object.entries(attributes)) {
+    const key = rawKey.startsWith(':') ? rawKey.slice(1) : rawKey
+    if (!SAFE_ATTR_NAME.test(key)) continue
+
+    if (rawKey.startsWith(':')) {
       if (value === 'true') {
-        parts.push(key.slice(1))
+        parts.push(key)
         continue
       }
       if (typeof value === 'object' && value !== null) {
-        parts.push(`${key.slice(1)}="${JSON.stringify(value).replace(/"/g, '\\"')}"`)
+        parts.push(`${key}="${escapeHtmlAttribute(JSON.stringify(value))}"`)
         continue
       }
-      parts.push(`${key.slice(1)}="${value}"`)
+      parts.push(`${key}="${escapeHtmlAttribute(value)}"`)
       continue
     }
 
@@ -212,11 +230,11 @@ export function htmlAttributes(attributes: Record<string, unknown>) {
     if (value === false || value === null || value === undefined) continue
 
     if (typeof value === 'object') {
-      parts.push(`${key}="${JSON.stringify(value).replace(/"/g, '\\"')}"`)
+      parts.push(`${key}="${escapeHtmlAttribute(JSON.stringify(value))}"`)
       continue
     }
 
-    parts.push(`${key}="${value}"`)
+    parts.push(`${key}="${escapeHtmlAttribute(value)}"`)
   }
   return parts.join(' ')
 }
diff --git a/packages/comark/test/html-escape.test.ts b/packages/comark/test/html-escape.test.ts
new file mode 100644
index 00000000..b61f1fc9
--- /dev/null
+++ b/packages/comark/test/html-escape.test.ts
@@ -0,0 +1,61 @@
+import { describe, expect, it } from 'vitest'
+import { parseMarkdown } from '../src/parse'
+import { render } from '../src/render'
+import type { Node } from '../src/types'
+
+const renderHtml = async (md: string, options?: Parameters<typeof parseMarkdown>[1]) =>
+  render(await parseMarkdown(md, options), { format: 'text/html', blockSeparator: '\n' })
+
+const renderNodes = async (nodes: Node[]) =>
+  render({ nodes, frontmatter: {}, meta: {} }, { format: 'text/html', blockSeparator: '\n' })
+
+describe('HTML attribute escaping', () => {
+  it('escapes double quotes in raw-HTML attribute values', async () => {
+    const html = await renderHtml(`<span title='a" onmouseover=alert(1)'>hi</span>`)
+    expect(html).toContain('title="a&quot; onmouseover=alert(1)"')
+    expect(html).not.toContain('title="a" onmouseover=alert(1)"')
+  })
+
+  it('escapes quotes in component attribute props', async () => {
+    const html = await renderHtml(`:span[hi]{title='a" onmouseover=alert(1) x="b'}`)
+    expect(html).toContain('title="a&quot; onmouseover=alert(1) x=&quot;b"')
+    expect(html).not.toContain('onmouseover=alert(1) x="b">')
+  })
+
+  it('escapes quotes in unquoted attribute values', async () => {
+    const html = await renderHtml(`:span[hi]{id=x"onmouseover="alert(1)}`)
+    expect(html).toContain('id="x&quot;onmouseover=&quot;alert(1)"')
+  })
+
+  it('escapes quotes in code fence info string meta', async () => {
+    const html = await renderHtml('```js " onmouseover="alert(1)\ncode\n```')
+    expect(html).not.toContain('" onmouseover="alert(1)">')
+    expect(html).toContain('&quot;')
+  })
+
+  it('escapes quotes in code fence filename', async () => {
+    const html = await renderHtml('```js [a" onmouseover="alert(1)]\ncode\n```')
+    expect(html).toContain('filename="a&quot; onmouseover=&quot;alert(1)"')
+  })
+
+  it('escapes quotes in image alt text', async () => {
+    const html = await renderHtml('![a" onerror="alert(1)](x.png)')
+    expect(html).not.toContain('alt="a" onerror="alert(1)"')
+  })
+
+  it('escapes ampersands and angle brackets in attribute values', async () => {
+    const html = await renderHtml(`<span title="a&b<c>d">hi</span>`)
+    expect(html).toContain('title="a&amp;b&lt;c&gt;d"')
+  })
+
+  it('escapes object attribute values as JSON with entities', async () => {
+    const html = await renderNodes([['div', { ':data': { x: '"><img src=x onerror=alert(1)>' } }, 'hi']])
+    expect(html).not.toContain('<img src=x onerror=alert(1)>')
+    expect(html).toContain('&quot;')
+  })
+
+  it('drops attribute names with unsafe characters', async () => {
+    const html = await renderNodes([['span', { '"onmouseover': 'alert(1)' }, 'hi']])
+    expect(html).not.toContain('onmouseover')
+  })
+})

From b1539048ea9a3e7b8a262be335eb57d13b357383 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Thu, 20 Aug 2026 19:48:03 +0200
Subject: [PATCH 02/16] fix(comark): use prototype-safe handler lookups in the
 stringifier

Handler maps are plain object literals, so a markdown component named
`constructor` resolved Object.prototype.constructor through the
prototype chain and was invoked as the node handler, emitting child
text without escaping. Names like `__proto__` or `valueOf` instead
threw and aborted the whole render.

Look up user and default handlers with Object.hasOwn so only real
handlers match.
---
 .../comark/src/internal/stringify/state.ts    | 13 ++++++++---
 packages/comark/test/html-escape.test.ts      | 22 +++++++++++++++++++
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/packages/comark/src/internal/stringify/state.ts b/packages/comark/src/internal/stringify/state.ts
index e44ecbfd..ae22d9e7 100644
--- a/packages/comark/src/internal/stringify/state.ts
+++ b/packages/comark/src/internal/stringify/state.ts
@@ -5,7 +5,13 @@ import { pascalCase } from '../../utils/index.ts'
 import { resolveAttributes } from './attributes.ts'
 
 function findHandler(ctx: Context, node: ElementNode): NodeHandler | undefined {
-  const userHandler = ctx.handlers[node[0] as string] || ctx.handlers[pascalCase(node[0] as string)]
+  const name = node[0] as string
+  // Own-property lookups only — the handler maps are plain objects, so a node
+  // named `constructor`/`__proto__`/… would otherwise resolve through the
+  // prototype chain (XSS / render crash from untrusted markdown).
+  const userHandler =
+    (Object.hasOwn(ctx.handlers, name) ? ctx.handlers[name] : undefined) ||
+    (Object.hasOwn(ctx.handlers, pascalCase(name)) ? ctx.handlers[pascalCase(name)] : undefined)
 
   if (typeof userHandler === 'function') {
     return userHandler
@@ -70,8 +76,9 @@ export async function one(node: Node, state: State, parent?: ElementNode, atLine
       return await state.handlers.html(node, state, parent)
     }
 
-    // fallback to default handlers
-    const nodeHandler = state.handlers[node[0] as string]
+    // fallback to default handlers (own-property lookup — see findHandler)
+    const nodeName = node[0] as string
+    const nodeHandler = Object.hasOwn(state.handlers, nodeName) ? state.handlers[nodeName] : undefined
     if (nodeHandler) {
       return await nodeHandler(node, state, parent)
     }
diff --git a/packages/comark/test/html-escape.test.ts b/packages/comark/test/html-escape.test.ts
index b61f1fc9..44e92a1f 100644
--- a/packages/comark/test/html-escape.test.ts
+++ b/packages/comark/test/html-escape.test.ts
@@ -59,3 +59,25 @@ describe('HTML attribute escaping', () => {
     expect(html).not.toContain('onmouseover')
   })
 })
+
+describe('prototype-safe handler lookup', () => {
+  it('does not invoke Object.prototype.constructor as a node handler', async () => {
+    const html = await renderNodes([['p', {}, 'before'], ['constructor', {}, '<img src=x onerror=alert(1)>']])
+    // The unknown element falls through to the generic html handler, which
+    // escapes text children — no raw markup may reach the output.
+    expect(html).not.toContain('<img src=x onerror=alert(1)>')
+    expect(html).toContain('<p>before</p>')
+  })
+
+  it('does not throw on __proto__ node names', async () => {
+    const html = await renderNodes([['__proto__', {}, 'x']])
+    expect(html).toContain('x')
+  })
+
+  it('does not throw on other Object.prototype member names', async () => {
+    for (const name of ['valueOf', 'hasOwnProperty', 'toString', 'isPrototypeOf']) {
+      const html = await renderNodes([[name, {}, 'x']])
+      expect(html).toContain('x')
+    }
+  })
+})

From d7df943604ca61bc88d15ed181d115a51a5070ec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Thu, 20 Aug 2026 20:18:18 +0200
Subject: [PATCH 03/16] fix(comark): sanitize footnote labels used in href/id
 attributes

Footnote labels were interpolated raw into href="#fn-<label>" and
id="fnref-<label>". A label containing a double quote broke out of
the attribute when rendered to HTML, injecting event-handler
attributes.

Encode any character outside [a-zA-Z0-9_-] as -<hex>- so references
and definitions still match and the emitted values stay inert.
---
 packages/comark/src/plugins/footnotes.ts | 20 ++++++++++++++++----
 packages/comark/test/html-escape.test.ts | 11 +++++++++++
 2 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/packages/comark/src/plugins/footnotes.ts b/packages/comark/src/plugins/footnotes.ts
index 8aa7451e..048cdaa9 100644
--- a/packages/comark/src/plugins/footnotes.ts
+++ b/packages/comark/src/plugins/footnotes.ts
@@ -26,6 +26,16 @@ export interface FootnotesConfig {
 // [^label]: content
 const FOOTNOTE_DEF_RE = /^\[\^([^\s\]]+)\]:[ \t]?(.*)$/gm
 
+/**
+ * Labels are author-controlled, so they must not leak raw characters into the
+ * `id`/`href` fragment values built below. Encode anything outside a safe
+ * charset as `-<hex>-` — deterministic, so references and definitions still
+ * match after sanitization.
+ */
+function sanitizeLabel(label: string): string {
+  return label.replace(/[^a-zA-Z0-9_-]/g, (char) => `-${char.charCodeAt(0).toString(16)}-`)
+}
+
 /**
  * Quick structural check: is this a ['span', {…}, string] tuple?
  * Used as the visit() checker to avoid running the full extraction
@@ -114,6 +124,7 @@ export default defineComarkPlugin((config: FootnotesConfig = {}) => {
           refIndexMap.set(refLabel, refIndexMap.size + 1)
         }
         const refIndex = refIndexMap.get(refLabel)!
+        const safeLabel = sanitizeLabel(refLabel)
 
         return [
           'sup',
@@ -121,8 +132,8 @@ export default defineComarkPlugin((config: FootnotesConfig = {}) => {
           [
             'a',
             {
-              href: `#fn-${refLabel}`,
-              id: `fnref-${refLabel}`,
+              href: `#fn-${safeLabel}`,
+              id: `fnref-${safeLabel}`,
             },
             `[${refIndex}]`,
           ],
@@ -156,13 +167,14 @@ export default defineComarkPlugin((config: FootnotesConfig = {}) => {
 
       for (const [refLabel] of refIndexMap) {
         const content = definitions.get(refLabel)!
+        const safeLabel = sanitizeLabel(refLabel)
 
         footnoteItems.push([
           'li',
-          { id: `fn-${refLabel}` },
+          { id: `fn-${safeLabel}` },
           content,
           ' ',
-          ['a', { href: `#fnref-${refLabel}`, class: 'footnote-backref' }, backRef],
+          ['a', { href: `#fnref-${safeLabel}`, class: 'footnote-backref' }, backRef],
         ])
       }
 
diff --git a/packages/comark/test/html-escape.test.ts b/packages/comark/test/html-escape.test.ts
index 44e92a1f..c0549d31 100644
--- a/packages/comark/test/html-escape.test.ts
+++ b/packages/comark/test/html-escape.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { parseMarkdown } from '../src/parse'
 import { render } from '../src/render'
+import footnotes from '../src/plugins/footnotes'
 import type { Node } from '../src/types'
 
 const renderHtml = async (md: string, options?: Parameters<typeof parseMarkdown>[1]) =>
@@ -81,3 +82,13 @@ describe('prototype-safe handler lookup', () => {
     }
   })
 })
+
+describe('footnote label sanitization', () => {
+  it('strips unsafe characters from footnote href/id values', async () => {
+    const md = `Hi[^a"onmouseover=alert(1)]\n\n[^a"onmouseover=alert(1)]: note`
+    const html = await renderHtml(md, { plugins: [footnotes()] })
+    // `"` -> -22-, `=` -> -3d-, `(` -> -28-, `)` -> -29-
+    expect(html).toContain('href="#fn-a-22-onmouseover-3d-alert-28-1-29-"')
+    expect(html).not.toContain('#fn-a"onmouseover')
+  })
+})

From 9da7473f34300331f2cd46b3c76bb75ed92662d0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Thu, 20 Aug 2026 20:19:07 +0200
Subject: [PATCH 04/16] fix(comark): restrict code fence language to safe
 characters

The fence info language regex admitted quotes and angle brackets even
though the value lands in the language attribute and language-* class
of the rendered HTML. Stop the language at those characters; any
remainder still parses as meta.
---
 packages/comark/src/internal/parse/token-processor.ts | 6 ++++--
 packages/comark/test/html-escape.test.ts              | 8 ++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/packages/comark/src/internal/parse/token-processor.ts b/packages/comark/src/internal/parse/token-processor.ts
index 4bfbb388..d41fdcdc 100644
--- a/packages/comark/src/internal/parse/token-processor.ts
+++ b/packages/comark/src/internal/parse/token-processor.ts
@@ -179,8 +179,10 @@ function parseCodeblockInfo(info: string): {
 
   let remaining = info.trim()
 
-  // Extract language (stops at [ or { or whitespace)
-  const languageMatch = remaining.match(/^([^\s[{]+)/)
+  // Extract language (stops at [ or { or whitespace).
+  // Quotes and angle brackets are excluded: the language lands in the
+  // `language` attr and `language-*` class of the rendered HTML.
+  const languageMatch = remaining.match(/^([^\s[{}"'<>`]+)/)
   if (languageMatch) {
     result.language = languageMatch[1]
     remaining = remaining.slice(languageMatch[1].length).trim()
diff --git a/packages/comark/test/html-escape.test.ts b/packages/comark/test/html-escape.test.ts
index c0549d31..7d73fb4b 100644
--- a/packages/comark/test/html-escape.test.ts
+++ b/packages/comark/test/html-escape.test.ts
@@ -92,3 +92,11 @@ describe('footnote label sanitization', () => {
     expect(html).not.toContain('#fn-a"onmouseover')
   })
 })
+
+describe('code fence language', () => {
+  it('stops the language at quotes and angle brackets', async () => {
+    const doc = await parseMarkdown('```js"><script>\ncode\n```')
+    const pre = doc.nodes[0] as [string, Record<string, unknown>, ...Node[]]
+    expect(pre[1].language).toBe('js')
+  })
+})

From f2448138aa66aa461a9c649c3b3c597dc34fd989 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Thu, 20 Aug 2026 20:30:33 +0200
Subject: [PATCH 05/16] fix(security): reject framework HTML sink props from
 markdown
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Markdown-authored innerHTML / dangerouslySetInnerHTML / textContent
props reached Vue h(), React createElement, Svelte spreads and the
Angular DOM renderer verbatim, injecting raw HTML even when
comark/plugins/security was enabled (validateProp only rejected on*,
srcdoc and formaction).

- Add innerhtml, dangerouslysetinnerhtml and textcontent to
  unsafeAttributes so the security plugin strips them at parse time
- resolveAttributes() (the shared prop-resolution point for all four
  framework renderers) now drops those keys unconditionally — raw HTML
  already has its own explicit path via the html plugin
- Remove the Angular renderer's dedicated el.innerHTML assignment
---
 .../src/components/markdown-node.component.ts |  6 ++--
 packages/comark-vue/test/sink-props.test.ts   | 30 +++++++++++++++++++
 .../comark/src/internal/props-validation.ts   |  7 ++++-
 .../src/internal/stringify/attributes.ts      | 18 ++++++++---
 packages/comark/test/plugins/security.test.ts | 18 +++++++++++
 packages/comark/test/props-validation.test.ts | 14 +++++++++
 .../comark/test/resolve-attributes.test.ts    | 29 ++++++++++++++++++
 7 files changed, 114 insertions(+), 8 deletions(-)
 create mode 100644 packages/comark-vue/test/sink-props.test.ts

diff --git a/packages/comark-angular/src/components/markdown-node.component.ts b/packages/comark-angular/src/components/markdown-node.component.ts
index f6e17d02..c6b50aa8 100644
--- a/packages/comark-angular/src/components/markdown-node.component.ts
+++ b/packages/comark-angular/src/components/markdown-node.component.ts
@@ -194,9 +194,9 @@ export class MarkdownNode implements OnChanges {
     const el = this.renderer.createElement(tag)
     this.applyAttributes(el, attrs)
 
-    if (attrs['innerHTML'] != null) {
-      el.innerHTML = attrs['innerHTML']
-    } else if (!VOID_ELEMENTS.has(tag)) {
+    // `innerHTML` from document attributes is never applied — resolveAttributes
+    // drops DOM sink props, and raw HTML has its own explicit parse path.
+    if (!VOID_ELEMENTS.has(tag)) {
       this.renderChildren(el, children, childrenRenderData)
     }
 
diff --git a/packages/comark-vue/test/sink-props.test.ts b/packages/comark-vue/test/sink-props.test.ts
new file mode 100644
index 00000000..c3c765d6
--- /dev/null
+++ b/packages/comark-vue/test/sink-props.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, it } from 'vitest'
+import { createSSRApp, h } from 'vue'
+import { renderToString } from '@vue/server-renderer'
+import { parseMarkdown } from 'comark'
+import { MarkdownDocument } from '../src/components/MarkdownDocument.ts'
+
+function renderDocument(document: unknown) {
+  const app = createSSRApp({
+    setup() {
+      return () => h(MarkdownDocument, { value: document })
+    },
+  })
+  return renderToString(app as any)
+}
+
+describe('HTML sink props', () => {
+  it('never forwards markdown-authored innerHTML to h()', async () => {
+    const document = await parseMarkdown('::div{innerHTML="<img src=x onerror=alert(1)>"}\n::')
+    const html = await renderDocument(document)
+    expect(html).not.toContain('<img src=x onerror=alert(1)>')
+    expect(html).not.toContain('onerror')
+  })
+
+  it('drops textContent and dangerouslySetInnerHTML props', async () => {
+    const document = await parseMarkdown(':span[safe]{textContent="overlay"}')
+    const html = await renderDocument(document)
+    expect(html).toContain('safe')
+    expect(html).not.toContain('overlay')
+  })
+})
diff --git a/packages/comark/src/internal/props-validation.ts b/packages/comark/src/internal/props-validation.ts
index f83d261d..06e9b71b 100644
--- a/packages/comark/src/internal/props-validation.ts
+++ b/packages/comark/src/internal/props-validation.ts
@@ -7,7 +7,12 @@ export const REJECTED_PROP = Symbol('comark:rejected-prop')
 
 export const unsafeTags = ['object']
 
-export const unsafeAttributes = ['srcdoc', 'formaction']
+// `innerHTML` / `dangerouslySetInnerHTML` / `textContent` are DOM sinks that
+// turn a string prop into raw markup or overwrite an element's children.
+// Framework renderers receive resolved props verbatim, so markdown-authored
+// values would otherwise bypass tag filtering (raw HTML has its own explicit
+// path via the `html` plugin and does not need these).
+export const unsafeAttributes = ['srcdoc', 'formaction', 'innerhtml', 'dangerouslysetinnerhtml', 'textcontent']
 
 export const unsafeLinkPrefix = [
   'javascript:',
diff --git a/packages/comark/src/internal/stringify/attributes.ts b/packages/comark/src/internal/stringify/attributes.ts
index 46821c01..536e6488 100644
--- a/packages/comark/src/internal/stringify/attributes.ts
+++ b/packages/comark/src/internal/stringify/attributes.ts
@@ -18,6 +18,13 @@ export interface ResolveAttributesOptions {
   parseJson?: boolean
 }
 
+// DOM sinks that turn a string/object prop into raw markup (`innerHTML`,
+// `dangerouslySetInnerHTML`) or overwrite an element's children
+// (`textContent`). Framework renderers hand resolved attributes to
+// `h()`/`createElement`/spreads verbatim, so these keys are never forwarded
+// from document attributes — raw HTML has its own explicit path.
+const HTML_SINK_PROPS = new Set(['innerhtml', 'dangerouslysetinnerhtml', 'textcontent'])
+
 /**
  * Resolve `:prefixed` attributes against the render context.
  *
@@ -42,29 +49,32 @@ export function resolveAttributes(
 
     const value = attrs[key]
     const isBinding = key.charCodeAt(0) === 58 /* ':' */
+    const outKey = isBinding ? key.slice(1) : key
+
+    if (HTML_SINK_PROPS.has(outKey.toLowerCase())) continue
 
     if (options.parseJson && isBinding) {
       // Framework mode: always strip `:` and hand components real JS values.
       if (typeof value === 'string') {
         try {
-          result[key.slice(1)] = JSON.parse(value)
+          result[outKey] = JSON.parse(value)
           continue
         } catch {
           // not JSON — fall through to dot-path lookup
         }
-        result[key.slice(1)] = get(renderData, value)
+        result[outKey] = get(renderData, value)
         continue
       }
       // Non-string binding value (e.g. an object literal the parser already
       // decoded) — pass through with the prefix stripped.
-      result[key.slice(1)] = value
+      result[outKey] = value
       continue
     }
 
     if (isBinding && typeof value === 'string') {
       const resolved = get(renderData, value)
       if (resolved !== undefined) {
-        result[key.slice(1)] = resolved
+        result[outKey] = resolved
         continue
       }
     }
diff --git a/packages/comark/test/plugins/security.test.ts b/packages/comark/test/plugins/security.test.ts
index 5c5b99fd..eb3e5253 100644
--- a/packages/comark/test/plugins/security.test.ts
+++ b/packages/comark/test/plugins/security.test.ts
@@ -273,6 +273,24 @@ click
     expect(anchor).toBeDefined()
     expect(anchor![1].href ?? anchor![1]['v-bind:href']).toBeUndefined()
   })
+
+  it('strips framework HTML sink props from components', async () => {
+    const tree = await parseWithSecurity(
+      `\
+::div{innerHTML="<img src=x onerror=alert(1)>"}
+::
+
+:span{:dangerouslySetInnerHTML='{"__html":"<img src=x onerror=alert(1)>"}'}
+`.trim()
+    )
+
+    const div = collectElements(tree.nodes).find((element) => element[0] === 'div')
+    const span = collectElements(tree.nodes).find((element) => element[0] === 'span')
+    expect(div).toBeDefined()
+    expect(div![1].innerHTML).toBeUndefined()
+    expect(span).toBeDefined()
+    expect(span![1][':dangerouslySetInnerHTML']).toBeUndefined()
+  })
 })
 
 describe('security plugin — blockedTags', () => {
diff --git a/packages/comark/test/props-validation.test.ts b/packages/comark/test/props-validation.test.ts
index 038182a6..097feb88 100644
--- a/packages/comark/test/props-validation.test.ts
+++ b/packages/comark/test/props-validation.test.ts
@@ -28,6 +28,20 @@ describe('validateProp', () => {
     it('blocks formaction', () => {
       expect(validateProp('formaction', 'https://evil.com')).toBe(REJECTED_PROP)
     })
+
+    it('blocks innerHTML (any case)', () => {
+      expect(validateProp('innerHTML', '<img src=x onerror=alert(1)>')).toBe(REJECTED_PROP)
+      expect(validateProp('innerHtml', '<img src=x onerror=alert(1)>')).toBe(REJECTED_PROP)
+      expect(validateProp('INNERHTML', '<img src=x onerror=alert(1)>')).toBe(REJECTED_PROP)
+    })
+
+    it('blocks dangerouslySetInnerHTML', () => {
+      expect(validateProp('dangerouslySetInnerHTML', { __html: '<img src=x onerror=alert(1)>' })).toBe(REJECTED_PROP)
+    })
+
+    it('blocks textContent', () => {
+      expect(validateProp('textContent', 'overlay')).toBe(REJECTED_PROP)
+    })
   })
 
   describe('href safety', () => {
diff --git a/packages/comark/test/resolve-attributes.test.ts b/packages/comark/test/resolve-attributes.test.ts
index e7960529..7aed3b2e 100644
--- a/packages/comark/test/resolve-attributes.test.ts
+++ b/packages/comark/test/resolve-attributes.test.ts
@@ -101,6 +101,35 @@ describe('resolveAttributes (parseJson mode)', () => {
   })
 })
 
+describe('HTML sink props', () => {
+  it('drops innerHTML / dangerouslySetInnerHTML / textContent from resolved attributes', () => {
+    const result = resolveAttributes(
+      {
+        innerHTML: '<img src=x onerror=alert(1)>',
+        textContent: 'overlay',
+        dangerouslySetInnerHTML: { __html: '<img src=x onerror=alert(1)>' },
+        title: 'safe',
+      },
+      makeRenderData(),
+    )
+    expect(result).toEqual({ title: 'safe' })
+  })
+
+  it('drops sink props with any casing and with the :binding prefix', () => {
+    const result = resolveAttributes(
+      {
+        InnerHtml: '<img src=x>',
+        ':dangerouslySetInnerHTML': '{"__html":"<img src=x>"}',
+        TEXTCONTENT: 'overlay',
+        id: 'keep',
+      },
+      makeRenderData(),
+      { parseJson: true },
+    )
+    expect(result).toEqual({ id: 'keep' })
+  })
+})
+
 describe('parseMarkdown + resolveAttributes end-to-end (#364)', () => {
   const renderData = makeRenderData()
 

From 25b82ca9853affcab387db778c634b61aa83c55f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Thu, 20 Aug 2026 20:32:19 +0200
Subject: [PATCH 06/16] fix(security): hold the as prop to the same tag filters

The as prop makes framework renderers resolve a different component
than the element's own tag, but the plugin only checked element[0]
against blockedTags/allowedTags. [x]{as="AdminPanel"} instantiated
any resolvable app component even under a strict allowedTags list.

Strip as when its value names a blocked or not-allowed tag; the
element then falls back to its own (already validated) tag.
---
 packages/comark/src/plugins/security.ts       | 12 +++++++
 packages/comark/test/plugins/security.test.ts | 31 +++++++++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/packages/comark/src/plugins/security.ts b/packages/comark/src/plugins/security.ts
index e7ccdfd5..924782aa 100644
--- a/packages/comark/src/plugins/security.ts
+++ b/packages/comark/src/plugins/security.ts
@@ -69,6 +69,18 @@ export default defineComarkPlugin((options: SecurityOptions = {}) => {
             return false
           }
 
+          // The `as` prop makes renderers resolve a different component than
+          // the element's own tag — hold it to the same tag filters, otherwise
+          // `[x]{as="AdminPanel"}` bypasses allowedTags/blockedTags.
+          const asValue = element[1].as
+          if (typeof asValue === 'string') {
+            const asTag = asValue.toLowerCase()
+            if (dropSet.has(asTag) || (allowSet.size > 0 && !allowSet.has(asTag))) {
+              console.warn(`[comark/plugins/security] removing unsafe attribute: as="${asValue}"`)
+              delete element[1].as
+            }
+          }
+
           const keys = Object.keys(element[1])
 
           /**
diff --git a/packages/comark/test/plugins/security.test.ts b/packages/comark/test/plugins/security.test.ts
index eb3e5253..34507800 100644
--- a/packages/comark/test/plugins/security.test.ts
+++ b/packages/comark/test/plugins/security.test.ts
@@ -408,6 +408,37 @@ describe('security plugin — allowedTags', () => {
   })
 })
 
+describe('security plugin — as prop', () => {
+  it('strips as pointing at a blocked tag', async () => {
+    const tree = makeTree([['span', { as: 'script' }, 'x']])
+    await runPlugin(tree, { blockedTags: ['script'] })
+    const el = tree.nodes[0] as [string, any]
+    expect(el[0]).toBe('span')
+    expect(el[1].as).toBeUndefined()
+  })
+
+  it('strips as pointing at a tag outside allowedTags', async () => {
+    const tree = makeTree([['span', { as: 'AdminPanel' }, 'x']])
+    await runPlugin(tree, { allowedTags: ['span'] })
+    const el = tree.nodes[0] as [string, any]
+    expect(el[1].as).toBeUndefined()
+  })
+
+  it('keeps as when the resolved tag is allowed', async () => {
+    const tree = makeTree([['span', { as: 'Badge' }, 'x']])
+    await runPlugin(tree, { allowedTags: ['span', 'badge'] })
+    const el = tree.nodes[0] as [string, any]
+    expect(el[1].as).toBe('Badge')
+  })
+
+  it('keeps as when no tag filters are configured', async () => {
+    const tree = makeTree([['span', { as: 'Badge' }, 'x']])
+    await runPlugin(tree)
+    const el = tree.nodes[0] as [string, any]
+    expect(el[1].as).toBe('Badge')
+  })
+})
+
 describe('security plugin — prop sanitization', () => {
   it('strips event handler props', async () => {
     const tree = makeTree([['div', { onclick: 'evil()', class: 'safe' }]])

From 3ae22e74500cd083389b4b8d78ba1c31897a7857 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Thu, 20 Aug 2026 20:34:38 +0200
Subject: [PATCH 07/16] fix(security): decode HTML entities before URL
 validation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Entities were stripped instead of decoded, so javascript&#58;alert(1)
became javascriptalert(1), failed URL parsing, and passed as a
'relative' URL — while browsers entity-decode the attribute back into
a live javascript: URL. Decode entities (numeric, hex, and the
scheme-relevant named ones) until stable before the protocol checks,
and stop throwing on malformed percent-encoding.
---
 .../comark/src/internal/props-validation.ts   | 54 +++++++++++++++++--
 packages/comark/test/props-validation.test.ts | 21 ++++++++
 2 files changed, 70 insertions(+), 5 deletions(-)

diff --git a/packages/comark/src/internal/props-validation.ts b/packages/comark/src/internal/props-validation.ts
index 06e9b71b..6df73fe6 100644
--- a/packages/comark/src/internal/props-validation.ts
+++ b/packages/comark/src/internal/props-validation.ts
@@ -45,6 +45,47 @@ function rewriteToDefaultOrigin(urlStr: string, defaultOrigin: string): string {
   }
 }
 
+// Named entities relevant to URL smuggling — the full HTML5 table is huge,
+// but these are the ones that can hide a scheme or whitespace inside it.
+const NAMED_ENTITIES: Record<string, string> = {
+  amp: '&',
+  lt: '<',
+  gt: '>',
+  quot: '"',
+  apos: "'",
+  colon: ':',
+  sol: '/',
+  bsol: '\\',
+  Tab: '\t',
+  NewLine: '\n',
+}
+
+/**
+ * Decode HTML entities until stable. Browsers entity-decode attribute values
+ * before navigating, so validation must inspect the decoded form — stripping
+ * entities instead (the previous behavior) let `javascript&#58;alert(1)`
+ * through as a "relative" URL. Repeating the pass catches nested encodings
+ * like `&amp;#58;`.
+ */
+function decodeHtmlEntities(value: string): string {
+  let result = value
+  for (let pass = 0; pass < 10; pass++) {
+    const decoded = result
+      .replace(/&#x([0-9a-f]+);?/gi, (match, hex) => {
+        const code = Number.parseInt(hex, 16)
+        return code <= 0x10ffff ? String.fromCodePoint(code) : match
+      })
+      .replace(/&#(\d+);?/g, (match, dec) => {
+        const code = Number.parseInt(dec, 10)
+        return code <= 0x10ffff ? String.fromCodePoint(code) : match
+      })
+      .replace(/&([a-z]+);?/gi, (match, name) => NAMED_ENTITIES[name] ?? match)
+    if (decoded === result) break
+    result = decoded
+  }
+  return result
+}
+
 function validateUrl(
   value: string,
   mode: 'link' | 'image',
@@ -58,11 +99,14 @@ function validateUrl(
     allowDataImages = true,
   } = options
 
-  const decodedUrl = decodeURIComponent(value)
-  const urlSanitized = decodedUrl
-    .replace(/&#x([0-9a-f]+);?/gi, '')
-    .replace(/&#(\d+);?/g, '')
-    .replace(/&[a-z]+;?/gi, '')
+  let decodedUrl: string
+  try {
+    decodedUrl = decodeURIComponent(value)
+  } catch {
+    // Malformed percent-encoding — inspect the raw value instead of throwing
+    decodedUrl = value
+  }
+  const urlSanitized = decodeHtmlEntities(decodedUrl)
 
   let url: URL
   try {
diff --git a/packages/comark/test/props-validation.test.ts b/packages/comark/test/props-validation.test.ts
index 097feb88..27883080 100644
--- a/packages/comark/test/props-validation.test.ts
+++ b/packages/comark/test/props-validation.test.ts
@@ -93,6 +93,27 @@ describe('validateProp', () => {
       expect(validateProp('href', 'data:text/vbscript,evil')).toBe(REJECTED_PROP)
     })
 
+    it('blocks entity-encoded javascript: hrefs', () => {
+      expect(validateProp('href', 'javascript&#58;alert(1)')).toBe(REJECTED_PROP)
+      expect(validateProp('href', 'javascript&#x3A;alert(1)')).toBe(REJECTED_PROP)
+      expect(validateProp('href', 'javascript&colon;alert(1)')).toBe(REJECTED_PROP)
+    })
+
+    it('blocks entity-encoded whitespace inside the scheme', () => {
+      expect(validateProp('href', 'jav&#x09;ascript:alert(1)')).toBe(REJECTED_PROP)
+      expect(validateProp('href', 'java&Tab;script:alert(1)')).toBe(REJECTED_PROP)
+      expect(validateProp('href', '&NewLine;javascript:alert(1)')).toBe(REJECTED_PROP)
+    })
+
+    it('blocks nested-encoded javascript: hrefs', () => {
+      expect(validateProp('href', 'javascript&amp;#58;alert(1)')).toBe(REJECTED_PROP)
+    })
+
+    it('allows safe URLs containing entities', () => {
+      expect(validateProp('href', '/search?q=a&amp;b=2')).toBe('/search?q=a&amp;b=2')
+      expect(validateProp('href', 'https://example.com/?a=1&amp;b=2')).toBe('https://example.com/?a=1&amp;b=2')
+    })
+
     it('blocks vbscript: hrefs', () => {
       expect(validateProp('href', 'vbscript:MsgBox(1)')).toBe(REJECTED_PROP)
     })

From 8bca76ce2e4e61be28c4928959ae7068e31451d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Thu, 20 Aug 2026 20:37:12 +0200
Subject: [PATCH 08/16] fix(security): resolve scheme-relative URLs and match
 prefix allowlists by origin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two allowlist bypasses in validateUrl:

- //evil.com and \\evil.com forms failed new URL() without a base and
  were returned as always-allowed 'relative' URLs, skipping the
  protocol and prefix checks entirely. Resolve against a fixed dummy
  origin — only inputs that stay on it are genuinely relative.
- allowedLinkPrefixes: ['https://myapp.com'] matched
  https://myapp.com.evil.com via raw startsWith. Absolute-URL prefixes
  now compare parsed origin plus a path-segment boundary.
---
 .../comark/src/internal/props-validation.ts   | 48 +++++++++++++++++--
 packages/comark/test/props-validation.test.ts | 33 +++++++++++++
 2 files changed, 77 insertions(+), 4 deletions(-)

diff --git a/packages/comark/src/internal/props-validation.ts b/packages/comark/src/internal/props-validation.ts
index 6df73fe6..7216c856 100644
--- a/packages/comark/src/internal/props-validation.ts
+++ b/packages/comark/src/internal/props-validation.ts
@@ -108,13 +108,30 @@ function validateUrl(
   }
   const urlSanitized = decodeHtmlEntities(decodedUrl)
 
+  // Dummy origin used to unmask scheme-relative (//host) and backslash
+  // (\\host) URLs: resolved against it, those land on the attacker's origin,
+  // while genuinely relative paths stay on the dummy origin.
+  const DUMMY_BASE = 'http://comark.invalid'
+
   let url: URL
   try {
     // Parse without a base — throws for relative URLs, succeeds for absolute
     url = new URL(urlSanitized)
   } catch {
-    // Relative URLs are always allowed
-    return value
+    let resolved: URL
+    try {
+      resolved = new URL(urlSanitized, DUMMY_BASE)
+    } catch {
+      // Unparseable even with a base — treat as relative
+      return value
+    }
+    if (resolved.origin === DUMMY_BASE) {
+      // Genuinely relative URLs are always allowed
+      return value
+    }
+    // Scheme-relative/backslash form — check it as the absolute URL it
+    // resolves to in the browser
+    url = resolved
   }
 
   // Block known-unsafe protocols — hard floor, not overrideable by options
@@ -138,8 +155,7 @@ function validateUrl(
   // Check allowed URL prefixes
   const allowedPrefixes = mode === 'link' ? allowedLinkPrefixes : allowedImagePrefixes
   if (!allowedPrefixes.includes('*')) {
-    const href = url.href.toLowerCase()
-    const matchesPrefix = allowedPrefixes.some((prefix) => href.startsWith(prefix.toLowerCase()))
+    const matchesPrefix = allowedPrefixes.some((prefix) => matchesAllowedPrefix(url, prefix))
     if (!matchesPrefix) {
       if (defaultOrigin) {
         return rewriteToDefaultOrigin(urlSanitized, defaultOrigin)
@@ -151,6 +167,30 @@ function validateUrl(
   return value
 }
 
+/**
+ * Whether `url` matches an allowed prefix. Absolute-URL prefixes compare by
+ * parsed origin plus a path-segment boundary, so a lookalike host such as
+ * `https://myapp.com.evil.com` never matches the prefix `https://myapp.com`.
+ * Non-URL prefixes (unusual) fall back to a raw string prefix match.
+ */
+function matchesAllowedPrefix(url: URL, prefix: string): boolean {
+  const normalized = prefix.toLowerCase()
+  if (!normalized.includes('://')) {
+    return url.href.toLowerCase().startsWith(normalized)
+  }
+  let prefixUrl: URL
+  try {
+    prefixUrl = new URL(normalized)
+  } catch {
+    return url.href.toLowerCase().startsWith(normalized)
+  }
+  if (url.origin.toLowerCase() !== prefixUrl.origin.toLowerCase()) return false
+  const prefixPath = prefixUrl.pathname
+  if (prefixPath === '/') return true
+  const path = url.pathname.toLowerCase()
+  return path === prefixPath || path.startsWith(prefixPath.endsWith('/') ? prefixPath : `${prefixPath}/`)
+}
+
 export function validateProp(attribute: string, value: unknown, options: PropsValidationOptions = {}): unknown {
   attribute = attribute
     .toLowerCase()
diff --git a/packages/comark/test/props-validation.test.ts b/packages/comark/test/props-validation.test.ts
index 27883080..99bcff22 100644
--- a/packages/comark/test/props-validation.test.ts
+++ b/packages/comark/test/props-validation.test.ts
@@ -244,6 +244,33 @@ describe('validateProp', () => {
         'https://any.com/img.png'
       )
     })
+
+    it('blocks scheme-relative URLs pointing at other hosts', () => {
+      expect(validateProp('href', '//evil.com/p', { allowedLinkPrefixes: ['https://myapp.com'] })).toBe(REJECTED_PROP)
+    })
+
+    it('blocks backslash-relative URLs pointing at other hosts', () => {
+      expect(validateProp('href', '\\\\evil.com/p', { allowedLinkPrefixes: ['https://myapp.com'] })).toBe(
+        REJECTED_PROP
+      )
+    })
+
+    it('blocks lookalike hosts that share a string prefix', () => {
+      expect(validateProp('href', 'https://myapp.com.evil.com/p', { allowedLinkPrefixes: ['https://myapp.com'] })).toBe(
+        REJECTED_PROP
+      )
+    })
+
+    it('allows subpaths of an allowed origin', () => {
+      expect(validateProp('href', 'https://myapp.com/docs/page', { allowedLinkPrefixes: ['https://myapp.com'] })).toBe(
+        'https://myapp.com/docs/page'
+      )
+    })
+
+    it('allows lookalike-host URLs with the default policy', () => {
+      expect(validateProp('href', 'https://myapp.com.evil.com/p')).toBe('https://myapp.com.evil.com/p')
+      expect(validateProp('href', '//evil.com/p')).toBe('//evil.com/p')
+    })
   })
 
   describe('allowedImagePrefixes', () => {
@@ -265,6 +292,12 @@ describe('validateProp', () => {
       )
     })
 
+    it('blocks scheme-relative src pointing at other hosts', () => {
+      expect(validateProp('src', '//tracker.evil.com/px.gif', { allowedImagePrefixes: ['https://cdn.myapp.com'] })).toBe(
+        REJECTED_PROP
+      )
+    })
+
     it('rewrites disallowed src to defaultOrigin when provided', () => {
       const result = validateProp('src', 'https://evil.com/tracker.gif', {
         allowedImagePrefixes: ['https://cdn.myapp.com'],

From 2276dc4df00367569424f325810e5a42cb05f91f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Thu, 20 Aug 2026 20:39:53 +0200
Subject: [PATCH 09/16] fix(security): validate the JSON-decoded form of
 :href/:src bindings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Renderers JSON-decode :binding values at render time, but validateProp
inspected the raw pre-resolution string. A JSON-quoted value like
'"javascript:alert(1)"' failed URL parsing, was classified as a
relative URL, and became a live javascript: href after the renderer's
JSON.parse — bypassing the plugin's protocol block and prefix
allowlists.

Decode the binding's JSON string before running URL validation, and
keep the original value when safe so the binding still resolves.
---
 .../comark/src/internal/props-validation.ts   | 29 +++++++++++++++----
 packages/comark/test/plugins/security.test.ts | 29 +++++++++++++++++++
 packages/comark/test/props-validation.test.ts | 20 +++++++++++++
 3 files changed, 72 insertions(+), 6 deletions(-)

diff --git a/packages/comark/src/internal/props-validation.ts b/packages/comark/src/internal/props-validation.ts
index 7216c856..3bc32bcc 100644
--- a/packages/comark/src/internal/props-validation.ts
+++ b/packages/comark/src/internal/props-validation.ts
@@ -192,6 +192,7 @@ function matchesAllowedPrefix(url: URL, prefix: string): boolean {
 }
 
 export function validateProp(attribute: string, value: unknown, options: PropsValidationOptions = {}): unknown {
+  const isBinding = /^(:|v-bind:)/.test(attribute)
   attribute = attribute
     .toLowerCase()
     .replace(/^(:|v-bind:)/, '')
@@ -201,15 +202,31 @@ export function validateProp(attribute: string, value: unknown, options: PropsVa
     return REJECTED_PROP
   }
 
-  if (attribute === 'href' || attribute === 'xlinkhref') {
-    // A non-string href can reach here as an array/object from the YAML
+  if (attribute === 'href' || attribute === 'xlinkhref' || attribute === 'src') {
+    // A non-string href/src can reach here as an array/object from the YAML
     // block-props JSON round-trip. Reject it instead of passing it through
     // unvalidated (#367).
-    return typeof value === 'string' ? validateUrl(value, 'link', options) : REJECTED_PROP
-  }
+    if (typeof value !== 'string') return REJECTED_PROP
+
+    // Renderers JSON-decode `:binding` values before use, so validate the
+    // decoded form — otherwise ':href' with '"javascript:..."' (a JSON-quoted
+    // string) fails URL parsing and slips through as a "relative" URL.
+    let effective = value
+    if (isBinding) {
+      try {
+        const parsed: unknown = JSON.parse(value)
+        if (typeof parsed === 'string') effective = parsed
+      } catch {
+        // Not JSON — a dot-path binding or literal, validated as-is
+      }
+    }
 
-  if (attribute === 'src') {
-    return typeof value === 'string' ? validateUrl(value, 'image', options) : REJECTED_PROP
+    const mode = attribute === 'src' ? 'image' : 'link'
+    const result = validateUrl(effective, mode, options)
+    if (result === REJECTED_PROP) return REJECTED_PROP
+    // Keep the original value so bindings still resolve at render time. The
+    // defaultOrigin rewrite only makes sense for literal URLs.
+    return isBinding ? value : result
   }
 
   return value
diff --git a/packages/comark/test/plugins/security.test.ts b/packages/comark/test/plugins/security.test.ts
index 34507800..a95f93f2 100644
--- a/packages/comark/test/plugins/security.test.ts
+++ b/packages/comark/test/plugins/security.test.ts
@@ -274,6 +274,35 @@ click
     expect(anchor![1].href ?? anchor![1]['v-bind:href']).toBeUndefined()
   })
 
+  it('rejects JSON-quoted javascript: URLs in :href bindings', async () => {
+    const tree = await parseWithSecurity(
+      `\
+::a{:href='"javascript:alert(1)"'}
+click
+::
+`.trim()
+    )
+
+    const anchor = collectElements(tree.nodes).find((element) => element[0] === 'a')
+    expect(anchor).toBeDefined()
+    expect(anchor![1].href).toBeUndefined()
+    expect(anchor![1][':href']).toBeUndefined()
+  })
+
+  it('keeps JSON-quoted safe URLs in :href bindings', async () => {
+    const tree = await parseWithSecurity(
+      `\
+::a{:href='"https://example.com"'}
+click
+::
+`.trim()
+    )
+
+    const anchor = collectElements(tree.nodes).find((element) => element[0] === 'a')
+    expect(anchor).toBeDefined()
+    expect(anchor![1][':href']).toBe('"https://example.com"')
+  })
+
   it('strips framework HTML sink props from components', async () => {
     const tree = await parseWithSecurity(
       `\
diff --git a/packages/comark/test/props-validation.test.ts b/packages/comark/test/props-validation.test.ts
index 99bcff22..dc8a7c08 100644
--- a/packages/comark/test/props-validation.test.ts
+++ b/packages/comark/test/props-validation.test.ts
@@ -273,6 +273,26 @@ describe('validateProp', () => {
     })
   })
 
+  describe('binding values', () => {
+    it('validates the JSON-decoded form of :href bindings', () => {
+      expect(validateProp(':href', '"javascript:alert(1)"')).toBe(REJECTED_PROP)
+      expect(validateProp('v-bind:href', '"javascript:alert(1)"')).toBe(REJECTED_PROP)
+      expect(validateProp(':src', '"data:text/html,<script>alert(1)</script>"')).toBe(REJECTED_PROP)
+    })
+
+    it('keeps the original binding string when the decoded URL is safe', () => {
+      expect(validateProp(':href', '"https://example.com"')).toBe('"https://example.com"')
+    })
+
+    it('passes dot-path bindings through unchanged', () => {
+      expect(validateProp(':href', 'frontmatter.home')).toBe('frontmatter.home')
+    })
+
+    it('does not JSON-decode plain (non-binding) hrefs', () => {
+      expect(validateProp('href', '"https://example.com"')).toBe('"https://example.com"')
+    })
+  })
+
   describe('allowedImagePrefixes', () => {
     it('allows src that matches an allowed prefix', () => {
       expect(

From 1cb4c5f815b0b3165ce7aa82b9fc8fa9e60e23d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Thu, 20 Aug 2026 20:48:07 +0200
Subject: [PATCH 10/16] docs(security): document sink-prop filtering, as-prop
 checks, and URL hardening

---
 docs/content/4.plugins/1.built-in/security.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/docs/content/4.plugins/1.built-in/security.md b/docs/content/4.plugins/1.built-in/security.md
index f1c1216b..2fad9ea3 100644
--- a/docs/content/4.plugins/1.built-in/security.md
+++ b/docs/content/4.plugins/1.built-in/security.md
@@ -96,6 +96,13 @@ Attributes that can be abused regardless of value are always stripped:
 |---|---|
 | `srcdoc` | Can contain arbitrary HTML |
 | `formaction` | Can redirect form submissions |
+| `innerHTML` | Injects raw HTML through framework renderers |
+| `dangerouslySetInnerHTML` | Injects raw HTML through framework renderers |
+| `textContent` | Overwrites an element's children |
+
+::note
+Framework renderers (Vue, React, Svelte, Angular) never forward `innerHTML`, `dangerouslySetInnerHTML`, or `textContent` from document attributes, even without this plugin. Raw HTML has its own explicit path through the default `html` plugin.
+::
 
 ### Protocol Blocking
 
@@ -103,6 +110,8 @@ Attributes that can be abused regardless of value are always stripped:
 
 `javascript:` · `vbscript:` · `data:text/html` · `data:text/javascript` · `data:text/vbscript` · `data:text/css` · `data:text/plain` · `data:text/xml`
 
+The same check applies to `:href` and `:src` bindings twice: on the JSON-decoded value at parse time, and again on the resolved value at render time, so bindings cannot smuggle an unsafe URL through frontmatter or other data sources.
+
 ::code-group
 
 ```html [Input]
@@ -177,6 +186,8 @@ security({
 })
 ```
 
+The `as` prop (which makes framework renderers resolve a different component than the element's own tag) is held to the same filters: an `as` value naming a blocked or not-allowed tag is stripped, and the element falls back to its own tag.
+
 ### `tagFallback`
 
 Defines the replacement strategy for tags that are filtered out because they are not present in the `allowedTags` (whitelist) or present in the `blockedTags` (blacklist).
@@ -212,6 +223,8 @@ The hard-coded unsafe protocols (`javascript:`, `vbscript:`, `data:text/*`) are
 
 Restricts which URLs are allowed in `href` attributes. Relative URLs (starting with `/`, `#`, etc.) are always allowed regardless of this setting.
 
+Prefixes compare by parsed origin plus a path-segment boundary, not by raw string matching: `https://myapp.com` allows `https://myapp.com/docs` but never a lookalike host such as `https://myapp.com.evil.com`. Scheme-relative URLs (`//evil.com/page`) resolve to an absolute URL and go through the same checks.
+
 When a URL does not match any prefix and `defaultOrigin` is set, the URL is rewritten instead of stripped.
 
 ```typescript

From bd2b84b2199bb98461f6cf0e90296fecd2c31137 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Thu, 20 Aug 2026 20:51:47 +0200
Subject: [PATCH 11/16] fix(comark): block unsafe protocols in binding-resolved
 URLs at render time
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The security plugin validates :href/:src bindings at parse time, but a
dot-path binding like :href="frontmatter.home" only shows the literal
path — frontmatter data it resolves to was never checked, letting
javascript: URLs through the documented sanitizer.

resolveAttributes() now applies the hard-floor unsafe-scheme check to
binding-resolved href/src/xlink:href values at render time,
independent of the security plugin. Literal attributes are untouched:
their parse-time validation remains the plugin's job.
---
 .../comark/src/internal/props-validation.ts   | 24 +++++++
 .../src/internal/stringify/attributes.ts      | 47 +++++++++-----
 packages/comark/test/plugins/security.test.ts | 18 +++++-
 packages/comark/test/props-validation.test.ts | 10 ++-
 .../comark/test/resolve-attributes.test.ts    | 63 ++++++++++++++++++-
 5 files changed, 139 insertions(+), 23 deletions(-)

diff --git a/packages/comark/src/internal/props-validation.ts b/packages/comark/src/internal/props-validation.ts
index 3bc32bcc..e83ec5c5 100644
--- a/packages/comark/src/internal/props-validation.ts
+++ b/packages/comark/src/internal/props-validation.ts
@@ -191,6 +191,30 @@ function matchesAllowedPrefix(url: URL, prefix: string): boolean {
   return path === prefixPath || path.startsWith(prefixPath.endsWith('/') ? prefixPath : `${prefixPath}/`)
 }
 
+/**
+ * Hard-floor check: does this string resolve to a known-unsafe URL scheme
+ * (`javascript:`, `data:text/html`, …)? Applied to binding-resolved values at
+ * render time so dot-path data (frontmatter/meta/data) cannot smuggle an
+ * unsafe URL past parse-time validation. Relative URLs are never unsafe here.
+ */
+export function isUnsafeUrlValue(value: string): boolean {
+  let decoded = value
+  try {
+    decoded = decodeURIComponent(value)
+  } catch {
+    // Malformed percent-encoding — inspect the raw value
+  }
+  const sanitized = decodeHtmlEntities(decoded)
+
+  let url: URL
+  try {
+    url = new URL(sanitized)
+  } catch {
+    return false
+  }
+  return unsafeLinkPrefix.some((prefix) => url.href.toLowerCase().startsWith(prefix))
+}
+
 export function validateProp(attribute: string, value: unknown, options: PropsValidationOptions = {}): unknown {
   const isBinding = /^(:|v-bind:)/.test(attribute)
   attribute = attribute
diff --git a/packages/comark/src/internal/stringify/attributes.ts b/packages/comark/src/internal/stringify/attributes.ts
index 536e6488..227a83a2 100644
--- a/packages/comark/src/internal/stringify/attributes.ts
+++ b/packages/comark/src/internal/stringify/attributes.ts
@@ -1,5 +1,6 @@
 import { stringifyYaml } from '../yaml.ts'
 import { get } from '../../utils/index.ts'
+import { isUnsafeUrlValue } from '../props-validation.ts'
 import type { NodeRenderData } from '../../types.ts'
 
 export interface ResolveAttributesOptions {
@@ -53,33 +54,51 @@ export function resolveAttributes(
 
     if (HTML_SINK_PROPS.has(outKey.toLowerCase())) continue
 
+    let outValue: unknown
+    let resultKey = key
+
     if (options.parseJson && isBinding) {
       // Framework mode: always strip `:` and hand components real JS values.
       if (typeof value === 'string') {
         try {
-          result[outKey] = JSON.parse(value)
-          continue
+          outValue = JSON.parse(value)
         } catch {
           // not JSON — fall through to dot-path lookup
+          outValue = get(renderData, value)
         }
-        result[outKey] = get(renderData, value)
-        continue
+      } else {
+        // Non-string binding value (e.g. an object literal the parser already
+        // decoded) — pass through with the prefix stripped.
+        outValue = value
       }
-      // Non-string binding value (e.g. an object literal the parser already
-      // decoded) — pass through with the prefix stripped.
-      result[outKey] = value
-      continue
-    }
-
-    if (isBinding && typeof value === 'string') {
+      resultKey = outKey
+    } else if (isBinding && typeof value === 'string') {
       const resolved = get(renderData, value)
       if (resolved !== undefined) {
-        result[outKey] = resolved
-        continue
+        outValue = resolved
+        resultKey = outKey
+      } else {
+        outValue = value
       }
+    } else {
+      outValue = value
     }
 
-    result[key] = value
+    // Hard floor: a binding must never resolve href/src to an unsafe scheme
+    // (javascript:, data:text/html, …). Parse-time validation only sees the
+    // literal path, so the resolved value is checked here — even when the
+    // security plugin is not enabled.
+    const lowerOutKey = outKey.toLowerCase()
+    if (
+      isBinding &&
+      (lowerOutKey === 'href' || lowerOutKey === 'src' || lowerOutKey === 'xlink:href') &&
+      typeof outValue === 'string' &&
+      isUnsafeUrlValue(outValue)
+    ) {
+      continue
+    }
+
+    result[resultKey] = outValue
   }
   return result
 }
diff --git a/packages/comark/test/plugins/security.test.ts b/packages/comark/test/plugins/security.test.ts
index a95f93f2..e28ed0f5 100644
--- a/packages/comark/test/plugins/security.test.ts
+++ b/packages/comark/test/plugins/security.test.ts
@@ -2,7 +2,7 @@ import { describe, expect, it } from 'vitest'
 import { parseMarkdown } from '../../src/parse'
 import security from '../../src/plugins/security'
 import { textContent } from '../../src/utils/index.ts'
-import { renderMarkdown } from 'comark/render'
+import { render, renderMarkdown } from 'comark/render'
 import type { ElementNode, Node, MarkdownDocument } from '../../src/types'
 
 const parseWithSecurity = (md: string, options: Parameters<typeof security>[0] = {}) =>
@@ -303,6 +303,22 @@ click
     expect(anchor![1][':href']).toBe('"https://example.com"')
   })
 
+  it('blocks javascript: URLs smuggled through frontmatter bindings at render time', async () => {
+    const md = `---
+home: javascript:alert(1)
+---
+
+[Home](placeholder){:href="frontmatter.home"}`
+
+    const tree = await parseWithSecurity(md)
+    // Parse-time validation only sees the literal dot-path…
+    const anchor = collectElements(tree.nodes).find((element) => element[0] === 'a')
+    expect(anchor).toBeDefined()
+    // …but the render-time hard floor drops the resolved unsafe URL.
+    const html = await render(tree, { format: 'text/html', blockSeparator: '\n' })
+    expect(html).not.toContain('javascript:')
+  })
+
   it('strips framework HTML sink props from components', async () => {
     const tree = await parseWithSecurity(
       `\
diff --git a/packages/comark/test/props-validation.test.ts b/packages/comark/test/props-validation.test.ts
index dc8a7c08..6c067de3 100644
--- a/packages/comark/test/props-validation.test.ts
+++ b/packages/comark/test/props-validation.test.ts
@@ -250,9 +250,7 @@ describe('validateProp', () => {
     })
 
     it('blocks backslash-relative URLs pointing at other hosts', () => {
-      expect(validateProp('href', '\\\\evil.com/p', { allowedLinkPrefixes: ['https://myapp.com'] })).toBe(
-        REJECTED_PROP
-      )
+      expect(validateProp('href', '\\\\evil.com/p', { allowedLinkPrefixes: ['https://myapp.com'] })).toBe(REJECTED_PROP)
     })
 
     it('blocks lookalike hosts that share a string prefix', () => {
@@ -313,9 +311,9 @@ describe('validateProp', () => {
     })
 
     it('blocks scheme-relative src pointing at other hosts', () => {
-      expect(validateProp('src', '//tracker.evil.com/px.gif', { allowedImagePrefixes: ['https://cdn.myapp.com'] })).toBe(
-        REJECTED_PROP
-      )
+      expect(
+        validateProp('src', '//tracker.evil.com/px.gif', { allowedImagePrefixes: ['https://cdn.myapp.com'] })
+      ).toBe(REJECTED_PROP)
     })
 
     it('rewrites disallowed src to defaultOrigin when provided', () => {
diff --git a/packages/comark/test/resolve-attributes.test.ts b/packages/comark/test/resolve-attributes.test.ts
index 7aed3b2e..bab8b0b2 100644
--- a/packages/comark/test/resolve-attributes.test.ts
+++ b/packages/comark/test/resolve-attributes.test.ts
@@ -110,7 +110,7 @@ describe('HTML sink props', () => {
         dangerouslySetInnerHTML: { __html: '<img src=x onerror=alert(1)>' },
         title: 'safe',
       },
-      makeRenderData(),
+      makeRenderData()
     )
     expect(result).toEqual({ title: 'safe' })
   })
@@ -124,12 +124,71 @@ describe('HTML sink props', () => {
         id: 'keep',
       },
       makeRenderData(),
-      { parseJson: true },
+      { parseJson: true }
     )
     expect(result).toEqual({ id: 'keep' })
   })
 })
 
+describe('unsafe URL bindings (render-time hard floor)', () => {
+  it('drops :href bindings resolving to javascript: via dot-path', () => {
+    const result = resolveAttributes(
+      { ':href': 'frontmatter.home' },
+      makeRenderData({ frontmatter: { home: 'javascript:alert(1)' } })
+    )
+    expect(result).toEqual({})
+  })
+
+  it('drops :href bindings resolving to javascript: via JSON (parseJson mode)', () => {
+    const result = resolveAttributes({ ':href': '"javascript:alert(1)"' }, makeRenderData(), { parseJson: true })
+    expect(result).toEqual({})
+  })
+
+  it('drops :src bindings resolving to data:text/html', () => {
+    const result = resolveAttributes({ ':src': '"data:text/html,<script>alert(1)</script>"' }, makeRenderData(), {
+      parseJson: true,
+    })
+    expect(result).toEqual({})
+  })
+
+  it('drops bindings whose resolved value is entity-encoded javascript:', () => {
+    const result = resolveAttributes(
+      { ':href': 'frontmatter.home' },
+      makeRenderData({ frontmatter: { home: 'javascript&#58;alert(1)' } })
+    )
+    expect(result).toEqual({})
+  })
+
+  it('keeps safe URL bindings', () => {
+    const result = resolveAttributes(
+      { ':href': 'frontmatter.home' },
+      makeRenderData({ frontmatter: { home: 'https://example.com' } })
+    )
+    expect(result).toEqual({ href: 'https://example.com' })
+  })
+
+  it('keeps relative URL bindings', () => {
+    const result = resolveAttributes(
+      { ':href': 'frontmatter.home' },
+      makeRenderData({ frontmatter: { home: '/about' } })
+    )
+    expect(result).toEqual({ href: '/about' })
+  })
+
+  it('does not drop literal javascript: hrefs — parse-time validation is the plugin\u2019s job', () => {
+    const result = resolveAttributes({ href: 'javascript:alert(1)' }, makeRenderData())
+    expect(result).toEqual({ href: 'javascript:alert(1)' })
+  })
+
+  it('does not drop non-URL bindings with unsafe-looking strings', () => {
+    const result = resolveAttributes(
+      { ':title': 'frontmatter.t' },
+      makeRenderData({ frontmatter: { t: 'javascript: is a scheme' } })
+    )
+    expect(result).toEqual({ title: 'javascript: is a scheme' })
+  })
+})
+
 describe('parseMarkdown + resolveAttributes end-to-end (#364)', () => {
   const renderData = makeRenderData()
 

From 6d2f1ea09f011ed139cd228bb6b5cca1283991ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Fri, 21 Aug 2026 12:54:49 +0200
Subject: [PATCH 12/16] style(comark): format html-escape test with oxfmt

---
 packages/comark/test/html-escape.test.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/packages/comark/test/html-escape.test.ts b/packages/comark/test/html-escape.test.ts
index 7d73fb4b..6551678d 100644
--- a/packages/comark/test/html-escape.test.ts
+++ b/packages/comark/test/html-escape.test.ts
@@ -63,7 +63,10 @@ describe('HTML attribute escaping', () => {
 
 describe('prototype-safe handler lookup', () => {
   it('does not invoke Object.prototype.constructor as a node handler', async () => {
-    const html = await renderNodes([['p', {}, 'before'], ['constructor', {}, '<img src=x onerror=alert(1)>']])
+    const html = await renderNodes([
+      ['p', {}, 'before'],
+      ['constructor', {}, '<img src=x onerror=alert(1)>'],
+    ])
     // The unknown element falls through to the generic html handler, which
     // escapes text children — no raw markup may reach the output.
     expect(html).not.toContain('<img src=x onerror=alert(1)>')

From 76805fc93a2bff60ad2c0e815bd9a49afe4d288d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Fri, 21 Aug 2026 12:58:43 +0200
Subject: [PATCH 13/16] test: update bundle size snapshot

---
 test/bundle.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/bundle.test.ts b/test/bundle.test.ts
index b553ccc9..3ee26115 100644
--- a/test/bundle.test.ts
+++ b/test/bundle.test.ts
@@ -67,7 +67,7 @@ describe('package bundle size', { timeout: 60_000 }, () => {
         "@comark/react": "43.6k (74 files)",
         "@comark/svelte": "43.9k (82 files)",
         "@comark/vue": "60.5k (78 files)",
-        "comark": "405k (154 files)",
+        "comark": "407k (158 files)",
       }
     `)
   })

From 24b834a47ba07ef2bd82f152c4c2aef5fad2dd45 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Fri, 21 Aug 2026 13:03:27 +0200
Subject: [PATCH 14/16] test: update bundle size snapshot

---
 test/bundle.test.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/bundle.test.ts b/test/bundle.test.ts
index 3ee26115..03e93163 100644
--- a/test/bundle.test.ts
+++ b/test/bundle.test.ts
@@ -60,14 +60,14 @@ describe('package bundle size', { timeout: 60_000 }, () => {
 
     expect(report).toMatchInlineSnapshot(`
       {
-        "@comark/angular": "54.5k (70 files)",
+        "@comark/angular": "54.6k (70 files)",
         "@comark/ansi": "38.7k (98 files)",
         "@comark/html": "18.6k (58 files)",
         "@comark/nuxt": "11.8k (58 files)",
         "@comark/react": "43.6k (74 files)",
         "@comark/svelte": "43.9k (82 files)",
         "@comark/vue": "60.5k (78 files)",
-        "comark": "407k (158 files)",
+        "comark": "415k (158 files)",
       }
     `)
   })

From ee4ab6dbf4951d766477cde325f024c6336280de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Chopin?= <atinux@gmail.com>
Date: Fri, 21 Aug 2026 15:27:51 +0200
Subject: [PATCH 15/16] test: correct comark file count in bundle snapshot

---
 test/bundle.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/bundle.test.ts b/test/bundle.test.ts
index 03e93163..5dd47097 100644
--- a/test/bundle.test.ts
+++ b/test/bundle.test.ts
@@ -67,7 +67,7 @@ describe('package bundle size', { timeout: 60_000 }, () => {
         "@comark/react": "43.6k (74 files)",
         "@comark/svelte": "43.9k (82 files)",
         "@comark/vue": "60.5k (78 files)",
-        "comark": "415k (158 files)",
+        "comark": "415k (154 files)",
       }
     `)
   })

From 4975780f138873f48606cdf4056025f324a7c649 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 25 Aug 2026 12:59:55 +0000
Subject: [PATCH 16/16] test: update bundle size snapshot

---
 test/bundle.test.ts | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/test/bundle.test.ts b/test/bundle.test.ts
index 5dd47097..12dfbb51 100644
--- a/test/bundle.test.ts
+++ b/test/bundle.test.ts
@@ -60,14 +60,14 @@ describe('package bundle size', { timeout: 60_000 }, () => {
 
     expect(report).toMatchInlineSnapshot(`
       {
-        "@comark/angular": "54.6k (70 files)",
-        "@comark/ansi": "38.7k (98 files)",
-        "@comark/html": "18.6k (58 files)",
+        "@comark/angular": "54.3k (70 files)",
+        "@comark/ansi": "41.5k (98 files)",
+        "@comark/html": "18.9k (58 files)",
         "@comark/nuxt": "11.8k (58 files)",
         "@comark/react": "43.6k (74 files)",
         "@comark/svelte": "43.9k (82 files)",
         "@comark/vue": "60.5k (78 files)",
-        "comark": "415k (154 files)",
+        "comark": "419k (154 files)",
       }
     `)
   })