GHSA-MXM6-V9R6-R94C @nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

Summary @nuxtjs/mdc renders untrusted markdown including raw HTML to a Vue component tree. Across two prior advisories it added a URL/attribute sanitizer to block dangerous links in that HTML: validateProps / validateProp and an unsafeLinkPrefix deny-list dist/runtime/parser/utils/props.js. The...

@4verburga/alpine-spanishplus (>=1.6.6, <=3.0.2), @4xeverburga/alpine-spanishplus (>=3.0.1, <=3.2.0) +175 more potentially affected by CVE-2026-63671 via @nuxtjs/mdc (>=0.1.6, <=0.21.1)

@nuxtjs/mdc NPM version =0.1.6, =1.6.6, =3.0.1, =0.0.1, =0.0.1, =0.1.1, =4.0.0, =0.0.2, =1.0.7, =1.0.7, =0.0.1, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =1.3.0 and more Source cves: CVE-2026-63671 Source advisory: SNYK:JS-NUXTJSMDC-19883915...

Incomplete List of Disallowed Inputs

Overview @nuxtjs/mdc is a Nuxt MDC module Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in validateProp and isAnchorLinkAllowed in src/runtime/parser/utils/props.ts. An attacker can execute script in the page origin or load active HTML in an iframe by...

@4verburga/alpine-spanishplus (>=1.6.6, <=3.0.2), @4xeverburga/alpine-spanishplus (>=3.0.1, <=3.2.0) +175 more potentially affected by CVE-2026-63671 via @nuxtjs/mdc (>=0.1.6, <=0.21.1)

@nuxtjs/mdc NPM version =0.1.6, =1.6.6, =3.0.1, =0.0.1, =0.0.1, =0.1.1, =4.0.0, =0.0.2, =1.0.7, =1.0.7, =0.0.1, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =1.3.0 and more Source cves: CVE-2026-63671 Source advisory: GHSA-MXM6-V9R6-R94C...

@4verburga/alpine-spanishplus (>=1.6.6, <=3.0.2), @4xeverburga/alpine-spanishplus (>=3.0.1, <=3.2.0) +175 more potentially affected by CVE-2026-63671 via @nuxtjs/mdc (>=0.1.6, <=0.21.1)

@nuxtjs/mdc NPM version =0.1.6, =1.6.6, =3.0.1, =0.0.1, =0.0.1, =0.1.1, =4.0.0, =0.0.2, =1.0.7, =1.0.7, =0.0.1, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =1.3.0 and more Source cves: CVE-2026-63671 Source advisory: OSV:GHSA-MXM6-V9R6-R94C...

@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

Summary @nuxtjs/mdc renders untrusted markdown including raw HTML to a Vue component tree. Across two prior advisories it added a URL/attribute sanitizer to block dangerous links in that HTML: validateProps / validateProp and an unsafeLinkPrefix deny-list dist/runtime/parser/utils/props.js. The...

CVE-2026-63671

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...

CVE-2026-63671 @nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...

EUVD-2026-80789

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...

CVE-2026-63671 @nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...

@4verburga/alpine-spanishplus (>=1.6.6, <=3.0.2), @4xeverburga/alpine-spanishplus (>=3.0.1, <=3.2.0) +175 more potentially affected by CVE-2026-63671 via @nuxtjs/mdc (>=0.1.6, <=0.21.1)

@nuxtjs/mdc NPM version =0.1.6, =1.6.6, =3.0.1, =0.0.1, =0.0.1, =0.1.1, =4.0.0, =0.0.2, =1.0.7, =1.0.7, =0.0.1, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =1.3.0 and more Source cves: CVE-2026-63671 Source advisory: MEND:CVE-2026-63671...

CVE-2026-63671 @nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...

CVE-2026-63671

@nuxtjs/mdc prior to 0.22.1 contains two gaps in its default URL sanitizer that enable cross-site scripting (XSS) from untrusted Markdown. First, validateProp checks only attributes named href or src, so an SVG xlink:href value (represented as xLinkHref) retains a javascript: URL that executes in...

PT-2026-93790

Name of the Vulnerable Software and Affected Versions @nuxtjs/mdc versions prior to 0.22.1 Description @nuxtjs/mdc renders untrusted Markdown to a Vue component tree and enables raw HTML by default via parseMarkdown with allowDangerousHtml set to true. The built-in sanitizer, which uses...

CVE-2026-63671: Improper Neutralization of Input During Web Page Generation

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...

@4verburga/alpine-spanishplus (>=1.6.6, <=3.0.2), @4xeverburga/alpine-spanishplus (>=3.0.1, <=3.2.0) +143 more potentially affected by CVE-2025-54075 via @nuxtjs/mdc (>=0.1.6, <=0.17.0)

@nuxtjs/mdc NPM version =0.1.6, =1.6.6, =3.0.1, =0.0.1, =0.0.1, =0.1.1, =0.0.2, =1.0.7, =1.0.7, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.0.3, =0.10.6 - @copity/copity 0.0.3 and more Source cves: CVE-2025-54075 Source advisory: OSV:GHSA-CJ6R-RRR9-FG82...

@4verburga/alpine-spanishplus (>=1.6.6, <=3.0.2), @4xeverburga/alpine-spanishplus (>=3.0.1, <=3.2.0) +143 more potentially affected by CVE-2025-54075 via @nuxtjs/mdc (>=0.1.6, <=0.17.0)

@nuxtjs/mdc NPM version =0.1.6, =1.6.6, =3.0.1, =0.0.1, =0.0.1, =0.1.1, =0.0.2, =1.0.7, =1.0.7, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.0.3, =0.10.6 - @copity/copity 0.0.3 and more Source cves: CVE-2025-54075 Source advisory: GHSA-CJ6R-RRR9-FG82...

CVE-2025-54075

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a "base href="https://attacker.tld"" element. The "" tag...

CVE-2025-54075 mdc vulnerable to XSS in markdown rendering bypassing HTML filter. (N°4)

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a element. The tag rewrites how all subsequent relative...

@4verburga/alpine-spanishplus (>=1.6.6, <=3.0.2), @4xeverburga/alpine-spanishplus (>=3.0.1, <=3.2.0) +143 more potentially affected by CVE-2025-54075 via @nuxtjs/mdc (>=0.1.6, <=0.17.0)

@nuxtjs/mdc NPM version =0.1.6, =1.6.6, =3.0.1, =0.0.1, =0.0.1, =0.1.1, =0.0.2, =1.0.7, =1.0.7, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.0.3, =0.10.6 - @copity/copity 0.0.3 and more Source cves: CVE-2025-54075 Source advisory: MEND:CVE-2025-54075...