CVE-2026-54889
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
XSS vulnerability in the mdex library for Elixir allows an attacker to inject JavaScript code via improper validation of URL schemes in Markdown to Quill Delta processing. An attacker can supply a malicious link with javascript: scheme in Markdown text, which is copied verbatim to the Delta attribute and executed in the victim's browser when rendered to HTML.
Risk Assessment
The risk involves arbitrary JavaScript execution in the user's browser, potentially leading to session theft, account takeover, or sensitive data leakage. The vulnerability affects versions from 0.8.3 to 0.13.1.
Recommendation
Immediately update the mdex library to version 0.13.2 or later, which includes a fix for URL scheme validation. If an update is not possible, apply additional URL validation on the Delta renderer side.
Other vulnerabilities in mdex
See all- CVE-2026-53428Medium
A vulnerability in the mdex and mdex_native libraries allows an unauthenticated attacker to cause a denial of service via unbounded memory allocation. The parse_highlight_lines function in the LumisAdapter component expands a user-controlled line range from a fenced code block without an upper bound, allocating huge vectors. A payload with a range like 1-2000000000 can exhaust host memory and abort the BEAM process.
- CVE-2026-53427Low
A cross-site scripting (XSS) vulnerability was found in the MDEx library due to improper input neutralization in Markdown processing. An attacker can inject arbitrary HTML/JavaScript that executes in the browser of every user viewing the rendered output.
- CVE-2026-54888Medium
A vulnerability in the mdex library (and mdex_native) allows a DoS attack by supplying a deeply nested Markdown document. Recursive conversion functions lack a maximum depth check, causing a C stack overflow and crashing the entire BEAM node.
- CVE-2026-53429Medium
A missing release of memory after effective lifetime vulnerability in mdex and mdex_native allows an attacker who controls a rendered document to cause a denial of service through unbounded native memory exhaustion. The native rendering code permanently leaks memory when rendering a document containing escaped-tag nodes, leading to unlimited memory consumption and process crash.
- CVE-2026-53426High
A vulnerability in the MDEx library for Elixir/Erlang allows exhaustion of the atom table by processing a specially crafted JSON document. The json_to_node/1 function creates new atoms for each unique node_type value, which are never garbage collected, leading to a crash of the entire BEAM virtual machine.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex allows cross-site scripting via unsanitized URL schemes in Quill Delta output. 'Elixir.MDEx':to_delta/2 converts Markdown into a Quill Delta. 'Elixir.MDEx.DeltaConverter':default_convert_node/3 in lib/mdex/delta_converter.ex copies the URL of a link, wikilink, or image node directly from the parsed Markdown into the Delta "link" or "image" attribute without applying a scheme allowlist or any normalization. An attacker who controls the Markdown text can supply a javascript: URL (for example [click](javascript:alert(document.cookie))) that survives verbatim into the Delta attribute. When the Delta is rendered to HTML by a downstream renderer (such as quill-delta-to-html or the Quill client), the attribute becomes an <a href> or <img src>, and the javascript: scheme executes in the browser of anyone who views the rendered content. The link and wikilink cases are the strongest vectors because javascript: in an href executes on click; the image case is lower impact because javascript: in <img src> generally does not execute in modern browsers. This issue affects mdex: from 0.8.3 before 0.13.2.