fix(security): add rehype-sanitize to prevent stored XSS in chat messages

apps/mesh/package.json

@@ -65,23 +65,24 @@
     "@dnd-kit/utilities": "^3.2.2",
     "@inkjs/ui": "^2.0.0",
     "@modelcontextprotocol/ext-apps": "^1.7.1",
+    "@nats-io/jetstream": "3.4.0",
+    "@nats-io/kv": "3.4.0",
+    "@nats-io/nats-core": "3.4.0",
+    "@nats-io/transport-node": "3.4.0",
     "@openrouter/ai-sdk-provider": "^2.9.1",
     "@opentelemetry/core": "^2.6.0",
     "@tanstack/react-virtual": "3.13.24",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
     "embedded-postgres": "^18.3.0-beta.16",
     "ink": "^6.8.0",
-    "@nats-io/jetstream": "3.4.0",
-    "@nats-io/kv": "3.4.0",
-    "@nats-io/nats-core": "3.4.0",
-    "@nats-io/transport-node": "3.4.0",
     "kysely": "^0.28.12",
     "node-pty": "^1.0.0",
     "posthog-js": "^1.371.1",
     "posthog-node": "^5.0.0",
     "react": "^19.2.6",
-    "react-dom": "^19.2.6"
+    "react-dom": "^19.2.6",
+    "rehype-sanitize": "^6.0.0"
   },
   "devDependencies": {
     "@ai-sdk/provider": "^3.0.10",

apps/mesh/src/web/components/chat/markdown.tsx

@@ -3,6 +3,7 @@ import { marked } from "marked";
 import React, { memo, useCallback, useMemo, useRef, useState } from "react";
 import ReactMarkdown from "react-markdown";
 import rehypeRaw from "rehype-raw";
+import rehypeSanitize from "rehype-sanitize";
 import remarkGfm from "remark-gfm";
 import { Prism as SyntaxHighlighter } from "react-syntax-highlighter";
 import { Button } from "@deco/ui/components/button.tsx";
@@ -129,7 +130,10 @@ function Table(props: React.HTMLAttributes<HTMLTableElement>) {
 
 // Memoize the plugins arrays to prevent re-creating them on every render
 const remarkPluginsMemo = [remarkGfm];
-const rehypePluginsMemo = [rehypeRaw];
+// rehypeRaw parses raw HTML in markdown; rehypeSanitize (GitHub schema)
+// strips dangerous elements (iframe, script, object, embed, form) and
+// attributes (srcdoc, on*) to prevent stored XSS via chat messages.
+const rehypePluginsMemo = [rehypeRaw, rehypeSanitize];
 
 // Extend shared markdown components with chat-specific overrides (table with CSV copy, image lightbox)
 const markdownComponents = {