DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-63671: CVE-2026-63671: Cross-Site Scripting (XSS) Sanitizer Bypass in @nuxtjs/mdc

#security #cve #cybersecurity

CVE-2026-63671: Cross-Site Scripting (XSS) Sanitizer Bypass in @nuxtjs/mdc

Vulnerability ID: CVE-2026-63671
CVSS Score: 8.1
Published: 2026-09-16

A cross-site scripting (XSS) vulnerability was identified in @nuxtjs/mdc prior to version 0.22.1. Gaps in the HTML/SVG attribute verification and URL protocol parsing allow unauthenticated remote attackers to bypass the application's sanitization routines. By embedding malicious SVG links or data-encoded iframe elements within Markdown, attackers can execute arbitrary JavaScript in the victim's browser context.

TL;DR

Unauthenticated XSS vulnerability in @nuxtjs/mdc prior to 0.22.1 allows attackers to bypass URL sanitizers and execute arbitrary scripts via crafted SVG xlink:href attributes and data:text/html URIs.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79, CWE-184
  • Attack Vector: Network
  • CVSS v3.1 Score: 8.1
  • Exploit Status: poc
  • KEV Status: Not listed
  • Impact: Cross-Site Scripting (XSS)

Affected Systems

  • @nuxtjs/mdc prior to version 0.22.1
  • Nuxt Content projects relying on vulnerable parser dependencies
  • @nuxtjs/mdc: < 0.22.1 (Fixed in: 0.22.1)

Code Analysis

Commit: 61d636c

fix(parser): validate xlinkhref and data URIs correctly

Exploit Details

Mitigation Strategies

  • Upgrade @nuxtjs/mdc to version 0.22.1 or newer
  • Disable raw and dangerous HTML rendering inside markdown parser settings by configuring allowDangerousHtml to false
  • Implement a strong Content Security Policy (CSP) restricting inline script execution and unauthorized data: schemes

Remediation Steps:

  1. Identify all project dependencies relying on @nuxtjs/mdc or nuxt-content
  2. Update the dependency using your package manager: npm install @nuxtjs/mdc@latest or pnpm update @nuxtjs/mdc
  3. Audit your markdown processing configurations to ensure unvalidated user inputs do not leverage allowDangerousHtml
  4. Deploy CSP headers restricting script-src elements to verified origins

References

Read the full report for CVE-2026-63671 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)