CVE-2025-54075

High

Published: 18/07/2025(UTC)Translated: 08/06/2026(UTC)NVD NIST

Summary

MDC is a tool for processing Markdown that prior to version 0.17.2 had a remote script-inclusion and stored XSS vulnerability. This allowed Markdown authors to inject a `<base>` element into documents, enabling attackers to load malicious resources from external sources.

Risk Assessment

This vulnerability poses a serious risk to organizations as it allows attackers to execute arbitrary JavaScript in the context of the site, potentially leading to data theft or session hijacking.

Recommendation

It is recommended to upgrade to version 0.17.2 or later to mitigate this vulnerability and to conduct a security audit of applications using MDC.

Other vulnerabilities in @nuxtjs/mdc

CVE-2026-63671High
@nuxtjs/mdc prior to 0.22.1 uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted Markdown. validateProp checks only attributes named href or src, allowing an SVG xlink:href value represented as xLinkHref to retain a javascript: URL, and data:text/html denylist entries are compared against url.protocol which is only data:, so an iframe src containing data:text/html survives sanitization.

Original NVD description (English source)

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a `<base href="https://attacker.tld">` element. The `<base>` tag rewrites how all subsequent relative URLs are resolved, so an attacker can make the page load scripts, styles, or images from an external, attacker-controlled origin and execute arbitrary JavaScript in the site’s context. Version 0.17.2 contains a fix for the issue.