EUVD-2026-40174Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Non-default configuration (syntax highlighting plus full_info_string: true both required) maps to AC:H; XSS executes in victim browser justifying S:C with limited C:L/I:L; no availability impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.
When syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence's highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line <div>. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as '"><script>alert(1)</script>' terminates the class attribute early and the markup that follows is emitted as live HTML.
An attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.
The vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched.
This issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.
AnalysisAI
Stored and reflected cross-site scripting in MDEx's Lumis syntax highlighting adapter allows attackers who can submit Markdown content to inject arbitrary HTML and JavaScript into rendered output viewed by other users, enabling session theft and account takeover. The flaw exists in the native Rust code shared between the mdex (0.11.3-0.12.2) and mdex_native (0.1.0-0.2.2) packages, where the highlight_lines_class code-fence attribute is interpolated into per-line HTML div class attributes without escaping. Exploitation requires a non-default rendering configuration (full_info_string: true with syntax highlighting enabled); no public exploit identified at time of analysis, and vendor-released patches are available.
Technical ContextAI
The vulnerability resides in the native Rust NIF (Native Implemented Function) code backing MDEx's Lumis syntax highlighting adapter, specifically in comrak_nif::lumis_adapter::LumisAdapter within native/comrak_nif/src/lumis_adapter.rs (original mdex package) and native/mdex_native_nif/src/lumis_adapter.rs (mdex_native package). The parse_custom_attributes function uses shlex parsing to extract key=value pairs from a Markdown code fence info string. When full_info_string: true rendering is active, the highlight_lines_class extracted value is stored verbatim, then interpolated directly into the class attribute of every per-line div element by write_highlighted without any HTML encoding. The shlex library's single-quote semantics preserve inner double-quote characters, so a crafted value such as '"><script>alert(1)</script>' escapes the class attribute context and injects live HTML into the DOM. CWE-79 (Improper Neutralization of Input During Web Page Generation) precisely describes this root cause: user-controlled data flows from input parsing into HTML output with no output encoding applied. Affected CPEs are cpe:2.3:a:leandrocp:mdex and cpe:2.3:a:leandrocp:mdex_native.
RemediationAI
Upgrade mdex to version 0.12.3 or later, and upgrade mdex_native to version 0.2.3 or later; the fix is delivered via patch commit 798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3 (https://github.com/leandrocp/mdex_native/commit/798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3). The vendor advisory is at https://github.com/leandrocp/mdex_native/security/advisories/GHSA-v664-pmxr-mxxx. If an immediate upgrade is not feasible, the most targeted compensating control is to remove or set to false the full_info_string: true render option, which eliminates the attack path at the cost of disabling custom info-string attribute forwarding in rendered output. Alternatively, disabling the Lumis syntax highlighting adapter entirely removes the vulnerable code path, at the cost of losing per-line syntax highlighting. As a defense-in-depth measure, restricting which users can submit Markdown content reduces attacker-controlled input and limits exposure, though it does not address the underlying flaw. A strict Content-Security-Policy header that blocks inline scripts would mitigate script-injection impact but not attribute-injection entirely.
Unauthenticated denial-of-service in MDEx, an Elixir/Erlang CommonMark parsing library, lets an attacker crash the entir
Stack exhaustion in the mdex and mdex_native Elixir Markdown libraries causes entire-node denial of service when process
Native Rust heap exhaustion in leandrocp mdex and mdex_native allows any attacker who can supply document content to MDE
Unbounded memory allocation in the MDEx Elixir Markdown rendering library allows a remote unauthenticated attacker to ex
Cross-site scripting in MDEx (Elixir Markdown library by leandrocp), versions 0.8.3 through 0.13.1, allows any attacker
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today