249 matches found
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
Summary @nuxtjs/mdc renders untrusted markdown including raw HTML to a Vue component tree. Across two prior advisories it added a URL/attribute sanitizer to block dangerous links in that HTML: validateProps / validateProp and an unsafeLinkPrefix deny-list dist/runtime/parser/utils/props.js. The...
CVE-2026-63671
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...
EUVD-2026-80789
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...
CVE-2026-63671
@nuxtjs/mdc prior to 0.22.1 contains two gaps in its default URL sanitizer that enable cross-site scripting (XSS) from untrusted Markdown. First, validateProp checks only attributes named href or src, so an SVG xlink:href value (represented as xLinkHref) retains a javascript: URL that executes in...
CVE-2026-63671 @nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...
CVE-2026-63671 @nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted...
EUVD-2025-175489
Malicious code in xerxes-nuxtjs-enif-superposition npm...
EUVD-2025-178760
Malicious code in gatsby-fornax-nuxtjs-vuetify npm...
Malicious code in nuxtjs-fomalhaut-postcss-avior (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b3531082acc33005105cb670ecb9ad95d910561eb968cd85dccd4a71b29b32d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-177512
Malicious code in nuxtjs-enceladus-miranda-jasmine npm...
MAL-2025-187689 Malicious code in kinetic-configstore-nuxtjs-colors (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d44184ccb146fc77b323b6e19c51c70a173fe426776802cee54b2452ea63418f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-188370 Malicious code in nuxtjs-enceladus-miranda-jasmine (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b43759d17c66985697b3c9e19ac0173377814fe579478b446243f3da452a55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-188377 Malicious code in nuxtjs-test-fornax-postgres (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06d5b29631fb2bda9c539656ce905f027cf1e1e09824995f998eb35c2ef8fde2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179806
Malicious code in chai-gatsby-coronalmassejection-nuxtjs npm...
EUVD-2025-176905
Malicious code in pulsar-graviton-dotenv-safe-nuxtjs npm...
EUVD-2025-178531
Malicious code in hexo-commitlint-config-angular-nuxtjs-neptune npm...
EUVD-2025-178193
Malicious code in kinetic-configstore-nuxtjs-colors npm...
EUVD-2025-177509
Malicious code in nuxtjs-hugo-karma-antares npm...
MAL-2025-188376 Malicious code in nuxtjs-steganography-dynamo-rocket (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4b011db95a7eefc14dc52ac07963321debbf596a0cb901153713ef86d2f4e28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...