Malicious code in sample-nuxtjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0517b841d711c41128943f51ef66b39a1841448b03eb175aec218d141d8fcdc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5793 Malicious code in sample-nuxtjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0517b841d711c41128943f51ef66b39a1841448b03eb175aec218d141d8fcdc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-24981 Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the javascript: protocol scheme in the URL. Th...

CVE-2025-24981 Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the javascript: protocol scheme in the URL. Th...

CVE-2025-24981

The CVE-2025-24981 vulnerability affects MDC (the Markdown-to-Vue integration used in @nuxtjs/mdc). The root cause is unsafe URL parsing in the parser (props.ts) that uses a deny-list for protocols (e.g., javascript:) but can be bypassed when the attacker provides hex-encoded HTML entities within...

@4verburga/alpine-spanishplus (>=1.6.6, <=3.0.2), @4xeverburga/alpine-spanishplus (>=3.0.1, <=3.2.0) +134 more potentially affected by CVE-2025-24981 via @nuxtjs/mdc (>=0.1.6, <=0.12.1)

@nuxtjs/mdc NPM version =0.1.6, =1.6.6, =3.0.1, =0.1.1, =0.0.2, =1.0.7, =1.0.7, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.0.3, =0.0.2, =0.0.1, =0.0.4 and more Source cves: CVE-2025-24981 Source advisory: OSV:GHSA-J82M-PC2V-2484...

GHSA-J82M-PC2V-2484 Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc

Summary An unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the javascript: protocol scheme in the URL. Details The parsing logic implement at...

PT-2025-5844 · Nuxt.Js · @Nuxtjs/Mdc

Name of the Vulnerable Software and Affected Versions: @nuxtjs/mdc versions prior to 0.13.3 Description: The issue arises from unsafe parsing logic of the URL from markdown, which can lead to arbitrary JavaScript code execution due to a bypass of the existing guards around the javascript: protoco...

Malicious code in nuxtjs_dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dcd288c0cffc74a3b962530a540a7cc62f2288445fd2f50c7aded40160d08871 The OpenSSF Package Analysis project identified 'nuxtjsdotenv' @ 1.4.1 npm as malicious. It is considered malicious because: - The package...