Read the docs
TI-2026-38509 Aliases CVE-2026-53427

Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute

Priority LOW 13CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown. When syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence's highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line <div>. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as '"><script>alert(1)</script>' terminates the class attribute early and the markup that follows is emitted as live HTML. An attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required. The vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched. This issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00688 52nd percentileScored 2026-11-07
Fix Fixed mdex (leandrocp): 0.12.3mdex_native (leandrocp): 0.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
leandrocpmdex0.11.3 to before 0.12.30.12.3Patch availableCNA
leandrocpmdex_native0.1.0 to before 0.2.30.2.3Patch availableCNA
  • mdex Vendorleandrocp Affected 0.11.3 to before 0.12.3 Fixed in 0.12.3 Patch available CNA
  • mdex_native Vendorleandrocp Affected 0.1.0 to before 0.2.3 Fixed in 0.2.3 Patch available CNA

CPE names CNA · 2

CPEVersionsRoleVendor
cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*——leandrocp
cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*——leandrocp
  • cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:* Versions — — ·leandrocp
  • cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:* Versions — — ·leandrocp

Remediation

  • Fix · CNA mdex (leandrocp) Fixed in 0.12.3
  • Fix · CNA mdex_native (leandrocp) Fixed in 0.2.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    leandrocp mdex, mdex_native 0.12.3, 0.2.3, 6ed94d905f97af188323f042698ae841c02293b4

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-39661 Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdexPriority MEDIUM 64
    • TI-2026-38511 Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of servicePriority MEDIUM 64
    • TI-2026-38510 Unbounded memory allocation in highlight_lines range expansion in mdexPriority LOW 30
    Show all 4 records →
  • Release ·

    leandrocp mdex_native 798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-38510 Unbounded memory allocation in highlight_lines range expansion in mdexPriority LOW 30
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53427

References

Patch 1

Advisory 1

Other 2

  • TI-2026-39661 Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex CVSS 4.0MEDIUM 6.9
  • TI-2026-38511 Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service CVSS 4.0MEDIUM 6.9
  • TI-2026-39662 Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS) CVSS 4.0MEDIUM 5.1
  • TI-2026-38508 Atom-table exhaustion denial-of-service via JSON parse_document in MDEx CVSS 4.0HIGH 8.2
  • TI-2026-38510 Unbounded memory allocation in highlight_lines range expansion in mdex CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences