XSS Vulnerability in mdex Affects Quill Delta Output by LeandroCP

CVE-2026-54889

What is CVE-2026-54889?

The mdex library, created by LeandroCP, is susceptible to an improper neutralization of input during web page generation, which allows for cross-site scripting (XSS). This vulnerability arises from the 'to_delta/2' function that converts Markdown into Quill Delta without appropriately sanitizing URL schemes. An attacker can manipulate Markdown content to include unsanitized 'javascript:' URLs, which are then directly rendered in HTML. This can lead to execution of JavaScript in the context of the user's browser when they interact with affected 'a' or 'img' elements, such as through clicks on links or viewing images. The issue impacts versions of mdex from 0.8.3 up to, but not including, 0.13.2.

References