CVE-2026-54889 Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.MDEx'",
      "'Elixir.MDEx.DeltaConverter'"
    ],
    "packageName": "mdex",
    "packageURL": "pkg:hex/mdex",
    "product": "mdex",
    "programFiles": [
      "lib/mdex.ex",
      "lib/mdex/delta_converter.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.MDEx':to_delta/2"
      },
      {
        "name": "'Elixir.MDEx.DeltaConverter':convert/2"
      },
      {
        "name": "'Elixir.MDEx.DeltaConverter':default_convert_node/3"
      }
    ],
    "repo": "https://github.com/leandrocp/mdex",
    "vendor": "leandrocp",
    "versions": [
      {
        "lessThan": "0.13.2",
        "status": "affected",
        "version": "0.8.3",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.MDEx'",
      "'Elixir.MDEx.DeltaConverter'"
    ],
    "packageName": "leandrocp/mdex",
    "packageURL": "pkg:github/leandrocp/mdex",
    "product": "mdex",
    "programFiles": [
      "lib/mdex.ex",
      "lib/mdex/delta_converter.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.MDEx':to_delta/2"
      },
      {
        "name": "'Elixir.MDEx.DeltaConverter':convert/2"
      },
      {
        "name": "'Elixir.MDEx.DeltaConverter':default_convert_node/3"
      }
    ],
    "repo": "https://github.com/leandrocp/mdex",
    "vendor": "leandrocp",
    "versions": [
      {
        "lessThan": "2817147f5b87ce7186aa604c9ee72499485b8f2f",
        "status": "affected",
        "version": "9852db2456fdc9d856eb636603a7f608e22e3793",
        "versionType": "git"
      }
    ]
  }
]