CVE-2026-63671: @nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted Markdown. validateProp checks only attributes named href or src, allowing an SVG xlink:href value represented as xLinkHref to retain a javascript: URL that executes in the page origin when selected. The data:text/html denylist entries are also compared against url.protocol, which is only data:, so an iframe src containing data:text/html survives sanitization and executes in an opaque origin when loaded. Plain href javascript: URLs, srcdoc, object, script, and base elements are already blocked, making these two paths specific sibling gaps in the sanitizer. This issue is fixed in version 0.22.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@nuxtjs/mdcto a version that resolves this vulnerability.Fixed in 0.22.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using @nuxtjs/mdc before 0.22.1 are exposed when they render Markdown from an untrusted source. The vulnerable behavior is enabled in the default configuration because parseMarkdown enables allowDangerousHtml by default.
What must an attacker provide to exploit it?
An attacker needs their Markdown content to be rendered by the application. They can use an SVG xLinkHref value carrying a javascript: URL, or an iframe src using data:text/html; user interaction is required according to the supplied severity vector.
What can run in the application origin?
The SVG xLinkHref path can execute a javascript: URL in the page origin when selected. The iframe data:text/html path executes when loaded, but does so in an opaque origin.
Are ordinary dangerous HTML and URL paths also affected?
No. Plain href javascript: URLs, srcdoc, object, script, and base elements are already blocked; the reported gaps are specifically SVG xLinkHref and iframe src values using data:text/html.
What is the available remediation?
Upgrade @nuxtjs/mdc to version 0.22.1, which fixes the issue.