EUVD-2026-80789Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Network-delivered untrusted Markdown, low complexity, no privileges; the iframe data:text/html path auto-executes on render so UI:N rather than the vendor's UI:R; classic XSS C:H/I:H, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted Markdown. validateProp checks only attributes named href or src, allowing an SVG xlink:href value represented as xLinkHref to retain a javascript: URL that executes in the page origin when selected. The data:text/html denylist entries are also compared against url.protocol, which is only data:, so an iframe src containing data:text/html survives sanitization and executes in an opaque origin when loaded. Plain href javascript: URLs, srcdoc, object, script, and base elements are already blocked, making these two paths specific sibling gaps in the sanitizer. This issue is fixed in version 0.22.1.
AnalysisAI
Client-side cross-site scripting in @nuxtjs/mdc before 0.22.1 allows attackers to execute arbitrary JavaScript in the page origin by smuggling executable URLs past the module's built-in Markdown sanitizer. Because parseMarkdown runs with allowDangerousHtml enabled by default and the sanitizer (validateProps/validateProp plus unsafeLinkPrefix) is the only defense, two sibling gaps are exploitable: an SVG anchor xlink:href (surfaced as the xLinkHref prop) carrying a javascript: URL, and an iframe src set to data:text/html that survives because the denylist compares url.protocol ('data:') rather than the full URL. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an application that renders attacker-controlled Markdown through @nuxtjs/mdc versions prior to 0.22.1 using parseMarkdown with allowDangerousHtml (the default), and relying on validateProp/validateProps/unsafeLinkPrefix for sanitization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, well-substantiated client-side XSS in @nuxtjs/mdc, corroborated across the vendor GitHub Security Advisory (GHSA-mxm6-v9r6-r94c), the fixing PR (#491), the merge commit (61d636c), and added regression tests that concretely prove both bypass paths. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade @nuxtjs/mdc to 0.22.1 (vendor-released patch; https://github.com/nuxt-content/mdc/releases/tag/v0.22.1), which is the version containing the fixes from PR #491 and commit 61d636c2983f021288e4fc5c4006733b38cf0d53; verify the resolved dependency tree since transitive consumers such as Nuxt Content may pin older ranges. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all use of @nuxtjs/mdc versions before 0.22.1 and identify any application paths that render attacker-controlled or untrusted Markdown; immediately disable allowDangerousHtml where possible, enforce strict Markdown input sanitization, and add a content security policy that blocks inline script and javascript: URLs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today