CVE-2026-63671: @nuxtjs/mdc XSS Vulnerability via SVG xlink:href and data:text/html
Summary
CVE-2026-63671: @nuxtjs/mdc renders untrusted markdown (including raw HTML) to a Vue component tree. Affects @nuxtjs/mdc versions < 0.22.1. Fixed in 0.22.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @nuxtjs/mdc package is a popular tool used in Vue.js applications for rendering markdown content, including raw HTML. It provides a way to safely parse and display markdown while attempting to sanitize potentially harmful links and attributes. However, due to its default configuration allowing raw HTML, it is vulnerable to cross-site scripting (XSS) attacks if not properly configured.
Vulnerability Detail
The vulnerability arises from the inadequate sanitization of certain attributes in the @nuxtjs/mdc package. Specifically, the sanitizer fails to check for the SVG attribute 'xlink:href' and allows 'data:text/html' URIs, which can lead to XSS attacks. An attacker can exploit this by injecting malicious JavaScript into the markdown content, which will be executed in the context of the user's browser when they interact with the rendered content. This vulnerability can compromise the security of the application and its users, allowing unauthorized script execution.
How To Fix
Latest published version: 0.23.2 as of 23 Oct 2026
npm install @nuxtjs/mdc@0.23.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.22.1
This is the first release that contains the fix.
npm install @nuxtjs/mdc@0.22.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider disabling the rendering of raw HTML by setting 'allowDangerousHtml' to false in your configuration. This will prevent the execution of any potentially harmful scripts. Example configuration: { allowDangerousHtml: false }.
Conclusion
The CVE-2026-63671 vulnerability in the @nuxtjs/mdc package poses a significant risk due to its potential for XSS attacks. It is crucial to update to the patched version or implement workarounds to protect your application and users from exploitation.
See every vulnerability recorded for @nuxtjs/mdc →
FAQ
CVE-2026-63671 is a security vulnerability in the @nuxtjs/mdc package that allows for cross-site scripting (XSS) attacks due to improper sanitization of SVG xlink:href and data:text/html attributes.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your package-lock.json without any signup.
The vulnerability can lead to unauthorized script execution in the user's browser, potentially compromising user data and application integrity.
Yes, a patch is available in version 0.22.1 of the @nuxtjs/mdc package. Updating to this version will resolve the vulnerability.
As a temporary measure, you can disable raw HTML rendering by setting 'allowDangerousHtml' to false in your configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for @nuxtjs/mdc.
