Description
@nuxtjs/mdc renders untrusted markdown (including raw HTML) to a Vue component tree. Across two prior advisories it added a URL/attribute sanitizer to block dangerous links in that HTML: validateProps / validateProp and an unsafeLinkPrefix deny-list (dist/runtime/parser/utils/props.js).
Recommendation
Update the @nuxtjs/mdc package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.22.1
- Patched version(s): 0.22.1
References
Could your website be exposed too?
SmartScanner can check your website for @nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the defaul and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc - CVE-2025-24981
- Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts - CVE-2026-116796
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
- @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stor - CVE-2026-108260
You might also like:
See something that needs correcting? Let us knowUpdated September 16, 2026