Vue
Monthly
Client-side cross-site scripting in @nuxtjs/mdc before 0.22.1 allows attackers to execute arbitrary JavaScript in the page origin by smuggling executable URLs past the module's built-in Markdown sanitizer. Because parseMarkdown runs with allowDangerousHtml enabled by default and the sanitizer (validateProps/validateProp plus unsafeLinkPrefix) is the only defense, two sibling gaps are exploitable: an SVG anchor xlink:href (surfaced as the xLinkHref prop) carrying a javascript: URL, and an iframe src set to data:text/html that survives because the denylist compares url.protocol ('data:') rather than the full URL. The vendor rates this CVSS 8.1, the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (unauthenticated per PR:N), and exploitation requires an application that renders attacker-controlled Markdown through the vulnerable versions. No CISA KEV listing or public exploit code was identified at time of analysis, though the fix PR (#491) and its regression tests publicly document both bypass payloads.
Client-side cross-site scripting in @nuxtjs/mdc before 0.22.1 allows attackers to execute arbitrary JavaScript in the page origin by smuggling executable URLs past the module's built-in Markdown sanitizer. Because parseMarkdown runs with allowDangerousHtml enabled by default and the sanitizer (validateProps/validateProp plus unsafeLinkPrefix) is the only defense, two sibling gaps are exploitable: an SVG anchor xlink:href (surfaced as the xLinkHref prop) carrying a javascript: URL, and an iframe src set to data:text/html that survives because the denylist compares url.protocol ('data:') rather than the full URL. The vendor rates this CVSS 8.1, the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (unauthenticated per PR:N), and exploitation requires an application that renders attacker-controlled Markdown through the vulnerable versions. No CISA KEV listing or public exploit code was identified at time of analysis, though the fix PR (#491) and its regression tests publicly document both bypass payloads.