CVE-2026-53427: MDEx Cross-Site Scripting Vulnerability via Unescaped Highlight Lines Class
Summary
CVE-2026-53427: Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute. Affects mdex across 3 version ranges.
>= 0.11.3, < 0.12.3
>= 0d7ffc84ea742e1daf666426814e5bb6d0499433, < 6ed94d905f97af188323f042698ae841c02293b4
>= 956528c5e31746253347029e810a969ab916fd27, < 798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3
Fixed in 0.12.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MDEx is a Markdown rendering library that supports syntax highlighting and various formatting options. It is widely used for rendering user-generated content in applications such as comments, posts, and documentation. The library allows for customization through attributes, but this flexibility can lead to security vulnerabilities if not properly managed.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, specifically in the handling of the highlight_lines_class attribute within code fences. When the Lumis adapter processes Markdown with full info-string forwarding enabled, it copies the value of the highlight_lines_class attribute directly into the class attribute of rendered lines without escaping it. This allows an attacker to inject arbitrary HTML and JavaScript, which can execute in the browsers of users viewing the content, leading to session theft and account takeover. The vulnerability affects versions of MDEx from 0.11.3 before 0.12.3 and mdex_native from 0.1.0 before 0.2.3.
How To Fix
Latest published version: 0.14.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, do not enable full info-string forwarding when rendering untrusted Markdown. This can be done by setting the render option to not include full info-string forwarding. Alternatively, restrict the values of highlight_lines_class to a safe character set, such as [A-Za-z0-9_-].
Conclusion
CVE-2026-53427 is a critical cross-site scripting vulnerability in the MDEx library that can lead to severe security issues. It is essential to update to the patched versions or implement the recommended workarounds to mitigate the risk. Utilizing tools like Vulert can further enhance your application's security posture.
See every vulnerability recorded for mdex →
FAQ
CVE-2026-53427 is a vulnerability in the MDEx library that allows for cross-site scripting (XSS) attacks through unescaped input in the highlight_lines_class attribute.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities in real-time.
The vulnerability can lead to session theft, account takeover, and other client-side attacks, affecting any user who views the compromised content.
Yes, the vulnerability has been patched in MDEx version 0.12.3 and mdex_native version 0.2.3. It is recommended to update to these versions.
Vulert is a monitoring tool that uses mix.lock to track open-source vulnerabilities in your software. It provides real-time alerts and can help you identify if your application is affected by vulnerabilities like CVE-2026-53427.
Related vulnerabilities
Recent vulnerabilities recorded for mdex.
