CVE-2026-63671

Versions of @nuxtjs/mdc, the Nuxt module that renders Markdown interleaved with Vue components, before 0.22.1 incompletely sanitize untrusted Markdown: parseMarkdown runs with allowDangerousHtml enabled by default, and the validateProps/validateProp/unsafeLinkPrefix helpers strip executable URLs only from attributes literally named href or src. An attacker who can inject Markdown can abuse an SVG link whose camelCase xLinkHref attribute retains a javascript: URL, which executes in the page origin when a victim clicks it, and can also set an iframe src to a data:text/html URL that the denylist misses (because it compares against url.protocol, which is only 'data:') and which executes attacker-controlled HTML on page load in an opaque origin. Successful exploitation gives the attacker script execution in the victim's browser session in the application's origin, enabling cookie/token theft and unauthorized actions (CVSS 8.1 high). Any Nuxt application using @nuxtjs/mdc to render Markdown supplied by users or less-trusted CMS sources is affected. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not listed in CISA KEV.

What to do: Upgrade @nuxtjs/mdc to version 0.22.1 or later. Until upgraded, do not render untrusted Markdown with the module, or pre-sanitize incoming Markdown to strip javascript: URLs (including SVG xLinkHref attributes) and data:text/html iframe src values. Audit Nuxt applications that accept Markdown from end users or third-party CMS content as the highest-priority targets for patching.