CVE-2026-0969

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0...

@aliceoq/library-test (>=1.3.2, <=1.3.3), @bentwnghk/chat (>=1.61.0, <=1.107.2) +170 more potentially affected by CVE-2026-0969 via next-mdx-remote (>=4.4.1, <=5.0.0)

next-mdx-remote NPM version =4.4.1, =1.3.2, =1.61.0, =1.1.1, =1.109.0, =0.0.2, =1.0.0, =0.1.1, =0.0.1, =2.13.2, =0.0.3, =0.2.0, =0.1.0, =0.5.0, =0.6.0 and more Source cves: CVE-2026-0969 Source advisory: OSV:GHSA-G4XW-JXRG-5F6M...

@aliceoq/library-test (>=1.3.2, <=1.3.3), @bentwnghk/chat (>=1.61.0, <=1.107.2) +170 more potentially affected by CVE-2026-0969 via next-mdx-remote (>=4.4.1, <=5.0.0)

next-mdx-remote NPM version =4.4.1, =1.3.2, =1.61.0, =1.1.1, =1.109.0, =0.0.2, =1.0.0, =0.1.1, =0.0.1, =2.13.2, =0.0.3, =0.2.0, =0.1.0, =0.5.0, =0.6.0 and more Source cves: CVE-2026-0969 Source advisory: SNYK:JS-NEXTMDXREMOTE-15282839...

CVE-2026-0969

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0...