Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc

Description

An unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the javascript: protocol scheme in the URL.

Recommendation

Update the @nuxtjs/mdc package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.13.2
• Patched version(s): 0.13.3

References

• GHSA-j82m-pc2v-2484
• CVE-2025-24981
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
• OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer - CVE-2025-50183
• Quill is vulnerable to XSS via HTML export feature - CVE-2025-15056
• MathLive's Lack of Escaping of HTML allows for XSS - CVE-2025-29049

Tags:

npm

@nuxtjs/mdc