CVE-2026-63671

HighCVSS 8.1

Published: 16/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 16/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

@nuxtjs/mdc prior to 0.22.1 uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted Markdown. validateProp checks only attributes named href or src, allowing an SVG xlink:href value represented as xLinkHref to retain a javascript: URL, and data:text/html denylist entries are compared against url.protocol which is only data:, so an iframe src containing data:text/html survives sanitization.

Risk Assessment

An attacker can inject malicious JavaScript or HTML, leading to code execution in the victim's browser context (XSS) and theft of session data.

Recommendation

Update @nuxtjs/mdc to version 0.22.1 or later.

Other vulnerabilities in @nuxtjs/mdc

CVE-2025-54075High
MDC is a tool for processing Markdown that prior to version 0.17.2 had a remote script-inclusion and stored XSS vulnerability. This allowed Markdown authors to inject a `<base>` element into documents, enabling attackers to load malicious resources from external sources.

Original NVD description (English source)

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted Markdown. validateProp checks only attributes named href or src, allowing an SVG xlink:href value represented as xLinkHref to retain a javascript: URL that executes in the page origin when selected. The data:text/html denylist entries are also compared against url.protocol, which is only data:, so an iframe src containing data:text/html survives sanitization and executes in an opaque origin when loaded. Plain href javascript: URLs, srcdoc, object, script, and base elements are already blocked, making these two paths specific sibling gaps in the sanitizer. This issue is fixed in version 0.22.1.