Description
An unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the javascript: protocol scheme in the URL.
Recommendation
Update the @nuxtjs/mdc package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.13.2
- Patched version(s): 0.13.3
References
Could your website be exposed too?
SmartScanner can check your website for Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
- Quill is vulnerable to XSS via HTML export feature - CVE-2025-15056
- Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS) - CVE-2025-27109
- JS Html Sanitizer allows XSS when used with contentEditable - CVE-2025-29771
You might also like:
See something that needs correcting? Let us knowUpdated February 06, 2025