CVE-2025-24981: XSS Vulnerability in @nuxtjs/mdc Due to Unsafe Markdown Parsing
Summary
CVE-2025-24981: Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc. Affects @nuxtjs/mdc versions < 0.13.3. Fixed in 0.13.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @nuxtjs/mdc package is a Markdown parsing library designed for use with Nuxt.js applications. It allows developers to convert Markdown content into HTML, enabling rich text formatting in web applications. However, due to its parsing logic, it is vulnerable to cross-site scripting (XSS) attacks when processing untrusted Markdown input, particularly through unsafe URL handling.
Vulnerability Detail
This vulnerability arises from an inadequate filtering mechanism in the Markdown parsing logic, which allows attackers to bypass existing security guards against malicious URL schemes. Specifically, the library's deny-list approach fails to account for HTML entity encoding, enabling adversaries to inject JavaScript code via crafted links. This could lead to arbitrary code execution in the context of the user's browser, compromising user data and application integrity.
How To Fix
Latest published version: 0.23.2 as of 23 Oct 2026
npm install @nuxtjs/mdc@0.23.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.13.3
This is the first release that contains the fix.
npm install @nuxtjs/mdc@0.13.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using untrusted Markdown sources or sanitize input before processing it with the @nuxtjs/mdc library. Implementing a robust input validation and sanitization mechanism can help mitigate the risk of XSS attacks.
Conclusion
The CVE-2025-24981 vulnerability in the @nuxtjs/mdc package poses a significant risk due to its inadequate handling of Markdown links, allowing for potential XSS attacks. It is crucial for developers to update to the patched version and implement proper input sanitization to safeguard their applications.
See every vulnerability recorded for @nuxtjs/mdc →
FAQ
CVE-2025-24981 is a critical vulnerability in the @nuxtjs/mdc package that allows for cross-site scripting (XSS) attacks due to unsafe parsing of Markdown links.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your package-lock.json without any signup.
If exploited, this vulnerability can allow attackers to execute arbitrary JavaScript in the context of the user's browser, potentially leading to data theft, session hijacking, or other malicious actions.
Yes, a patch is available in version 0.13.3 of the @nuxtjs/mdc package. Updating to this version will mitigate the vulnerability.
If immediate updating is not possible, ensure that you sanitize all Markdown input and avoid processing untrusted sources until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for @nuxtjs/mdc.
