GHSA-MXM6-V9R6-R94C @nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

Summary @nuxtjs/mdc renders untrusted markdown including raw HTML to a Vue component tree. Across two prior advisories it added a URL/attribute sanitizer to block dangerous links in that HTML: validateProps / validateProp and an unsafeLinkPrefix deny-list dist/runtime/parser/utils/props.js. The...

Incomplete List of Disallowed Inputs

Overview @nuxtjs/mdc is a Nuxt MDC module Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in validateProp and isAnchorLinkAllowed in src/runtime/parser/utils/props.ts. An attacker can execute script in the page origin or load active HTML in an iframe by...

@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

Summary @nuxtjs/mdc renders untrusted markdown including raw HTML to a Vue component tree. Across two prior advisories it added a URL/attribute sanitizer to block dangerous links in that HTML: validateProps / validateProp and an unsafeLinkPrefix deny-list dist/runtime/parser/utils/props.js. The...

CVE-2026-63671

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...

EUVD-2026-80789

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...

CVE-2026-63671

@nuxtjs/mdc prior to 0.22.1 contains two gaps in its default URL sanitizer that enable cross-site scripting (XSS) from untrusted Markdown. First, validateProp checks only attributes named href or src, so an SVG xlink:href value (represented as xLinkHref) retains a javascript: URL that executes in...

CVE-2026-63671 @nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...

CVE-2026-63671 @nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...

CVE-2026-63671 @nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...

CVE-2026-63671: Improper Neutralization of Input During Web Page Generation

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...

@4verburga/alpine-spanishplus (>=1.6.6, <=3.0.2), @4xeverburga/alpine-spanishplus (>=3.0.1, <=3.2.0) +142 more potentially affected by CVE-2025-54075 via @nuxtjs/mdc (>=0.1.6, <=0.17.0)

@nuxtjs/mdc NPM version =0.1.6, =1.6.6, =3.0.1, =0.0.1, =0.0.1, =0.1.1, =0.0.2, =1.0.7, =1.0.7, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.0.3, =0.10.6 - @copity/copity 0.0.3 and more Source cves: CVE-2025-54075 Source advisory: OSV:GHSA-CJ6R-RRR9-FG82...

CVE-2025-54075 mdc vulnerable to XSS in markdown rendering bypassing HTML filter. (N°4)

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a element. The tag rewrites how all subsequent relative...

CVE-2025-54075: Improper Neutralization of Input During Web Page Generation

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a element. The tag rewrites how all subsequent relative...

CVE-2025-24981 Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the javascript: protocol scheme in the URL. Th...

CVE-2025-24981 Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the javascript: protocol scheme in the URL. Th...

CVE-2025-24981

The CVE-2025-24981 vulnerability affects MDC (the Markdown-to-Vue integration used in @nuxtjs/mdc). The root cause is unsafe URL parsing in the parser (props.ts) that uses a deny-list for protocols (e.g., javascript:) but can be bypassed when the attacker provides hex-encoded HTML entities within...

@4verburga/alpine-spanishplus (>=1.6.6, <=3.0.2), @4xeverburga/alpine-spanishplus (>=3.0.1, <=3.2.0) +134 more potentially affected by CVE-2025-24981 via @nuxtjs/mdc (>=0.1.6, <=0.12.1)

@nuxtjs/mdc NPM version =0.1.6, =1.6.6, =3.0.1, =0.1.1, =0.0.2, =1.0.7, =1.0.7, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.0.3, =0.0.2, =0.0.1, =0.0.4 and more Source cves: CVE-2025-24981 Source advisory: OSV:GHSA-J82M-PC2V-2484...

PT-2025-5844 · Nuxt.Js · @Nuxtjs/Mdc

Name of the Vulnerable Software and Affected Versions: @nuxtjs/mdc versions prior to 0.13.3 Description: The issue arises from unsafe parsing logic of the URL from markdown, which can lead to arbitrary JavaScript code execution due to a bypass of the existing guards around the javascript: protoco...