Cross-Site Scripting Vulnerability in @nuxtjs/mdc

The @nuxtjs/mdc package is vulnerable to Cross-Site Scripting (XSS) due to insufficient sanitization of untrusted markdown input (CVE-2026-63671). The library parses markdown into a Vue component tree and uses a sanitizer to block dangerous HTML attributes and URI schemes. However, the sanitizer's attribute-checking logic only validates href and src, allowing the xlink:href attribute on SVG elements to pass through unvalidated. Attackers can inject a javascript: URI within an SVG <a> tag, which executes in the context of the page's origin when clicked.

Additionally, the sanitizer's deny-list implementation for URI schemes fails to correctly handle data: URIs. It compares the data: protocol string against the list of forbidden prefixes, causing the check to consistently fail and permitting <iframe> elements to load data:text/html content. Since iframe is not included in the library's list of dangerous tags, this allows the execution of arbitrary script content within an opaque origin. These vulnerabilities exist by default, as the library enables dangerous HTML rendering without requiring custom configuration.

Impact

Successful exploitation allows attackers to perform XSS attacks against users viewing markdown content rendered by @nuxtjs/mdc. This can lead to session hijacking, sensitive data theft, or arbitrary actions performed on behalf of the victim within the application context. The vulnerability affects all implementations of @nuxtjs/mdc version 0.22.1 and earlier that process user-supplied markdown.

Recommendation

• Upgrade @nuxtjs/mdc to version 0.22.1 or later immediately to patch the sanitization logic.
• Audit applications currently using @nuxtjs/mdc to determine if they render untrusted user input, as this represents the primary threat vector for CVE-2026-63671.
• If upgrading is not immediately possible, implement a secondary layer of sanitization or a strict Content Security Policy (CSP) that restricts frame-src and script-src to minimize the potential impact of injected scripts.