Remote Script Inclusion and XSS in @nuxtjs/mdc Affects Nuxt.js Applications
CVE-2025-54075

8.3HIGH

Key Information:

Vendor

Nuxt-modules

Status
Mdc
Vendor
CVE Published:
18 July 2025

What is CVE-2025-54075?

A vulnerability in @nuxtjs/mdc prior to version 0.17.2 allows a malicious Markdown author to inject a HTML element. This element manipulates the resolution of subsequent relative URLs, potentially redirecting them to an external server controlled by an attacker. As a result, scripts, styles, or images can be loaded and executed in the context of the victim's site, leading to the possibility of arbitrary JavaScript execution and data compromise.

Affected Version(s)

mdc < 0.17.2

References

https://github.com/nuxt-modules/mdc/security/advisories/G...
x_refsource_CONFIRM
https://github.com/nuxt-modules/mdc/commit/3657a5bf2326a7...
x_refsource_MISC

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-54075 : Remote Script Inclusion and XSS in @nuxtjs/mdc Affects Nuxt.js Applications