CVE-2026-53427 Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.MDEx'",
      "comrak_nif"
    ],
    "packageName": "mdex",
    "packageURL": "pkg:hex/mdex",
    "product": "mdex",
    "programFiles": [
      "native/comrak_nif/src/lumis_adapter.rs"
    ],
    "programRoutines": [
      {
        "name": "comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes"
      },
      {
        "name": "comrak_nif::lumis_adapter::LumisAdapter::highlight_lines_config"
      },
      {
        "name": "comrak_nif::lumis_adapter::LumisAdapter::write_highlighted"
      },
      {
        "name": "'Elixir.MDEx':to_html/2"
      }
    ],
    "repo": "https://github.com/leandrocp/mdex",
    "vendor": "leandrocp",
    "versions": [
      {
        "lessThan": "0.12.3",
        "status": "affected",
        "version": "0.11.3",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.MDEx'",
      "comrak_nif"
    ],
    "packageName": "leandrocp/mdex",
    "packageURL": "pkg:github/leandrocp/mdex",
    "product": "mdex",
    "programFiles": [
      "native/comrak_nif/src/lumis_adapter.rs"
    ],
    "programRoutines": [
      {
        "name": "comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes"
      },
      {
        "name": "comrak_nif::lumis_adapter::LumisAdapter::highlight_lines_config"
      },
      {
        "name": "comrak_nif::lumis_adapter::LumisAdapter::write_highlighted"
      },
      {
        "name": "'Elixir.MDEx':to_html/2"
      }
    ],
    "repo": "https://github.com/leandrocp/mdex",
    "vendor": "leandrocp",
    "versions": [
      {
        "lessThan": "6ed94d905f97af188323f042698ae841c02293b4",
        "status": "affected",
        "version": "0d7ffc84ea742e1daf666426814e5bb6d0499433",
        "versionType": "git"
      }
    ]
  },
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.MDExNative.Comrak'",
      "mdex_native_nif"
    ],
    "packageName": "mdex_native",
    "packageURL": "pkg:hex/mdex_native",
    "product": "mdex_native",
    "programFiles": [
      "native/mdex_native_nif/src/lumis_adapter.rs"
    ],
    "programRoutines": [
      {
        "name": "mdex_native_nif::lumis_adapter::LumisAdapter::parse_custom_attributes"
      },
      {
        "name": "mdex_native_nif::lumis_adapter::LumisAdapter::highlight_lines_config"
      },
      {
        "name": "mdex_native_nif::lumis_adapter::LumisAdapter::write_highlighted"
      },
      {
        "name": "'Elixir.MDExNative.Native':document_to_html_with_options/2"
      },
      {
        "name": "'Elixir.MDExNative.Comrak':document_to_html/2"
      }
    ],
    "repo": "https://github.com/leandrocp/mdex_native",
    "vendor": "leandrocp",
    "versions": [
      {
        "lessThan": "0.2.3",
        "status": "affected",
        "version": "0.1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.MDExNative.Comrak'",
      "mdex_native_nif"
    ],
    "packageName": "leandrocp/mdex_native",
    "packageURL": "pkg:github/leandrocp/mdex_native",
    "product": "mdex_native",
    "programFiles": [
      "native/mdex_native_nif/src/lumis_adapter.rs"
    ],
    "programRoutines": [
      {
        "name": "mdex_native_nif::lumis_adapter::LumisAdapter::parse_custom_attributes"
      },
      {
        "name": "mdex_native_nif::lumis_adapter::LumisAdapter::highlight_lines_config"
      },
      {
        "name": "mdex_native_nif::lumis_adapter::LumisAdapter::write_highlighted"
      },
      {
        "name": "'Elixir.MDExNative.Native':document_to_html_with_options/2"
      },
      {
        "name": "'Elixir.MDExNative.Comrak':document_to_html/2"
      }
    ],
    "repo": "https://github.com/leandrocp/mdex_native",
    "vendor": "leandrocp",
    "versions": [
      {
        "lessThan": "798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3",
        "status": "affected",
        "version": "956528c5e31746253347029e810a969ab916fd27",
        "versionType": "git"
      }
    ]
  }
]