CLSA-2026-1792364004 TuxCare security update for @next/mdx (9 CVEs)

TuxCare rebuilt @next/mdx to address 9 CVEs. Fixed in 16.0.6-tuxcare.7...

CLSA-2026-1792364002 TuxCare security update for @next/mdx (13 CVEs)

TuxCare rebuilt @next/mdx to address 13 CVEs. Fixed in 13.5.11-tuxcare.14...

CLSA-2026-1792363988 TuxCare security update for @next/mdx (9 CVEs)

TuxCare rebuilt @next/mdx to address 9 CVEs. Fixed in 14.2.35-tuxcare.5...

CLSA-2026-1792363986 TuxCare security update for @next/mdx (2 CVEs)

TuxCare rebuilt @next/mdx to address 2 CVEs. Fixed in 12.3.7-tuxcare.8...

Remote Code Execution (RCE)

next-mdx-remote is vulnerable to Remote Code Execution RCE. The vulnerability is due to insufficient sanitization of MDX content in the serialize function, which allows an attacker to execute arbitrary code...

CVE-2026-0969

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0...

@aliceoq/library-test (>=1.3.2, <=1.3.3), @bragdoc/cli (>=1.1.1, <=1.5.1) +169 more potentially affected by CVE-2026-0969 via next-mdx-remote (>=4.4.1, <=5.0.0)

next-mdx-remote NPM version =4.4.1, =1.3.2, =1.1.1, =1.109.0, =0.0.2, =1.0.0, =0.2.0, =0.1.1, =0.0.1, =2.13.2, =0.0.3, =0.2.0, =0.1.0, =0.5.0, =0.0.66, =0.1.10-0 and more Source cves: CVE-2026-0969 Source advisory: OSV:GHSA-G4XW-JXRG-5F6M...

@aliceoq/library-test (>=1.3.2, <=1.3.3), @bragdoc/cli (>=1.1.1, <=1.5.1) +169 more potentially affected by CVE-2026-0969 via next-mdx-remote (>=4.4.1, <=5.0.0)

next-mdx-remote NPM version =4.4.1, =1.3.2, =1.1.1, =1.109.0, =0.0.2, =1.0.0, =0.2.0, =0.1.1, =0.0.1, =2.13.2, =0.0.3, =0.2.0, =0.1.0, =0.5.0, =0.0.66, =0.1.10-0 and more Source cves: CVE-2026-0969 Source advisory: GHSA-G4XW-JXRG-5F6M...

CVE-2026-0969

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0...

@aliceoq/library-test (>=1.3.2, <=1.3.3), @bragdoc/cli (>=1.1.1, <=1.5.1) +169 more potentially affected by CVE-2026-0969 via next-mdx-remote (>=4.4.1, <=5.0.0)

next-mdx-remote NPM version =4.4.1, =1.3.2, =1.1.1, =1.109.0, =0.0.2, =1.0.0, =0.2.0, =0.1.1, =0.0.1, =2.13.2, =0.0.3, =0.2.0, =0.1.0, =0.5.0, =0.0.66, =0.1.10-0 and more Source cves: CVE-2026-0969 Source advisory: SNYK:JS-NEXTMDXREMOTE-15282839...

CVE-2026-0969 Arbitrary code execution in React server-side rendering of untrusted MDX content

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0...

CVE-2026-0969

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0...

CVE-2026-0969 Arbitrary code execution in React server-side rendering of untrusted MDX content

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0...

@aliceoq/library-test (>=1.3.2, <=1.3.3), @bragdoc/cli (>=1.1.1, <=1.5.1) +169 more potentially affected by CVE-2026-0969 via next-mdx-remote (>=4.4.1, <=5.0.0)

next-mdx-remote NPM version =4.4.1, =1.3.2, =1.1.1, =1.109.0, =0.0.2, =1.0.0, =0.2.0, =0.1.1, =0.0.1, =2.13.2, =0.0.3, =0.2.0, =0.1.0, =0.5.0, =0.0.66, =0.1.10-0 and more Source cves: CVE-2026-0969 Source advisory: MEND:CVE-2026-0969...

Arbitrary code execution in React server-side rendering of untrusted MDX content

Summary The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0. Background next-mdx-remote is an open-source TypeScript library th...

CVE-2026-0969: Improper Control of Generation of Code

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0...

PT-2026-7809

Name of the Vulnerable Software and Affected Versions next-mdx-remote versions 4.3.0 through 5.0.0 Description The serialize function within next-mdx-remote is susceptible to arbitrary code execution because of inadequate sanitization of MDX content. This allows untrusted MDX to execute JavaScrip...