org.webjars.npm:remark-mdx-frontmatter (5.1.0), org.webjars.npm:snyk-go-plugin (1.5.2) potentially affected by CVE-2026-77465 via org.webjars.npm:toml (>=2.3.3, <=3.0.0)

org.webjars.npm:toml MAVEN version =2.3.3, =3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:toml and may be impacted: - org.webjars.npm:remark-mdx-frontmatter 5.1.0 - org.webjars.npm:snyk-go-plugin 1.5.2 Source cves: CVE-2026-7746...

CVE-2026-55661

CVE-2026-55661 affects TinaCMS rich-text rendering (Slate JSON) where the url field on Slate link/image nodes was not sanitized, allowing stored XSS via dangerous URL schemes such as javascript: or data:text/html. Affected versions include tinacms/mdx &lt;2.1.7 and tinacms =2.1.7 and tinacms &gt;...

@tinacms/app (>=0.0.0-0b7103c-20251216023146, <=2.3.24), @tinacms/cli (>=0.0.0-0b7103c-20251216023146, <=2.1.5) +5 more potentially affected by CVE-2026-55661 via @tinacms/mdx (>=2.0.0, <=2.1.6)

@tinacms/mdx NPM version =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =3.4.1 Source cves: CVE-2026-55661 Source...

@tinacms/app (>=0.0.0-0b7103c-20251216023146, <=2.3.24), @tinacms/cli (>=0.0.0-0b7103c-20251216023146, <=2.1.5) +5 more potentially affected by CVE-2026-55661 via @tinacms/mdx (>=2.0.0, <=2.1.6)

@tinacms/mdx NPM version =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =3.4.1 Source cves: CVE-2026-55661 Source...

TinaCMS 安全漏洞

TinaCMS is an open-source headless CMS developed by Tina for Markdown, MDX, and JSON formats. Versions of TinaCMS prior to 2.2.2 contained a security vulnerability. This vulnerability stemmed from string-based path validation in FilesystemBridge, which allowed operations on files outside of the...

Remote Code Execution (RCE)

next-mdx-remote is vulnerable to Remote Code Execution RCE. The vulnerability is due to insufficient sanitization of MDX content in the serialize function, which allows an attacker to execute arbitrary code...

CVE-2026-0969

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0...

@aliceoq/library-test (>=1.3.2, <=1.3.3), @bragdoc/cli (>=1.1.1, <=1.5.1) +167 more potentially affected by CVE-2026-0969 via next-mdx-remote (>=4.4.1, <=5.0.0)

next-mdx-remote NPM version =4.4.1, =1.3.2, =1.1.1, =1.109.0, =0.0.2, =1.0.0, =0.1.1, =0.0.1, =2.13.2, =0.0.3, =0.2.0, =0.1.0, =0.5.0, =0.0.66, =0.1.10-0 and more Source cves: CVE-2026-0969 Source advisory: OSV:GHSA-G4XW-JXRG-5F6M...

CVE-2026-0969

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0...

Arbitrary Code Injection

Overview next-mdx-remote is an utilities for loading mdx from any remote source as data, rather than as a local import Affected versions of this package are vulnerable to Arbitrary Code Injection via the serialize function. An attacker can execute arbitrary code by submitting specially crafted MD...

@aliceoq/library-test (>=1.3.2, <=1.3.3), @bragdoc/cli (>=1.1.1, <=1.5.1) +167 more potentially affected by CVE-2026-0969 via next-mdx-remote (>=4.4.1, <=5.0.0)

next-mdx-remote NPM version =4.4.1, =1.3.2, =1.1.1, =1.109.0, =0.0.2, =1.0.0, =0.1.1, =0.0.1, =2.13.2, =0.0.3, =0.2.0, =0.1.0, =0.5.0, =0.0.66, =0.1.10-0 and more Source cves: CVE-2026-0969 Source advisory: SNYK:JS-NEXTMDXREMOTE-15282839...

CVE-2026-0969

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0...

CVE-2026-0969 Arbitrary code execution in React server-side rendering of untrusted MDX content

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0...

CVE-2026-0969 Arbitrary code execution in React server-side rendering of untrusted MDX content

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0...

Arbitrary code execution in React server-side rendering of untrusted MDX content

Summary The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0. Background next-mdx-remote is an open-source TypeScript library th...

PT-2026-7809

Name of the Vulnerable Software and Affected Versions next-mdx-remote versions 4.3.0 through 5.0.0 Description The serialize function within next-mdx-remote is susceptible to arbitrary code execution because of inadequate sanitization of MDX content. This allows untrusted MDX to execute JavaScrip...

CVE-2026-0969: Improper Control of Generation of Code

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0...

EUVD-2022-55774

In the Linux kernel, the following vulnerability has been resolved: md/raid1: stop mdxraid1 thread when raid1 array run failed fail run raid1 array when we assemble array with the inactive disk only, but the mdxraid1 thread were not stop, Even if the associated resources have been released. it wi...

CVE-2022-50715

In the Linux kernel, the following vulnerability has been resolved: md/raid1: stop mdxraid1 thread when raid1 array run failed fail run raid1 array when we assemble array with the inactive disk only, but the mdxraid1 thread were not stop, Even if the associated resources have been released. it wi...

CVE-2022-50715

In the Linux kernel, the following vulnerability has been resolved: md/raid1: stop mdxraid1 thread when raid1 array run failed fail run raid1 array when we assemble array with the inactive disk only, but the mdxraid1 thread were not stop, Even if the associated resources have been released. it wi...