CVE-2025-54075: XSS Vulnerability in @nuxtjs/mdc Markdown Rendering
Summary
CVE-2025-54075: Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering. Affects @nuxtjs/mdc versions < 0.17.2. Fixed in 0.17.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @nuxtjs/mdc package is a Markdown component for Nuxt.js applications, enabling developers to render Markdown content seamlessly. It is widely used in various applications, including blogs, content management systems, and documentation sites. However, it has a critical vulnerability that allows for remote script inclusion, posing significant security risks.
Vulnerability Detail
A remote script-inclusion/stored XSS vulnerability exists in @nuxtjs/mdc, allowing a Markdown author to inject a <base href="https://attacker.tld"> element. This <base> tag alters how relative URLs are resolved, enabling attackers to load scripts or other resources from their own domains, executing arbitrary JavaScript in the context of the vulnerable site. The flaw originates from insufficient validation in the validateProp() function, which fails to check the <base> tag, allowing malicious attributes to pass through unchecked.
How To Fix
Minimum fixed version
0.17.2
This is the first release that contains the fix.
npm install @nuxtjs/mdc@0.17.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Until the package is updated, you can disable raw HTML in Markdown or use an external sanitizer like DOMPurify. Here is an example of how to configure DOMPurify to forbid <base> tags:
const cleanHTML = DOMPurify.sanitize(dirtyHTML, { FORBID_TAGS: ['base'] });
Conclusion
The @nuxtjs/mdc package has a critical XSS vulnerability that can lead to severe security implications for applications using it. It is crucial to update to the patched version or implement workarounds to protect against potential attacks. Regular monitoring with tools like Vulert can help maintain security in your applications.
See every vulnerability recorded for @nuxtjs/mdc →
FAQ
The vulnerability is a stored XSS that allows attackers to inject malicious scripts via the <base> tag in Markdown content.
If exploited, attackers can execute arbitrary JavaScript in the context of your site, leading to session hijacking, credential theft, or defacement.
Yes, the vulnerability is patched in version 0.17.2 of @nuxtjs/mdc. Updating to this version will resolve the issue.
You can disable raw HTML in Markdown or implement an external sanitizer like DOMPurify to mitigate the risk temporarily.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for @nuxtjs/mdc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
