Security Flaw in Vue Component Markdown Conversion Tool by Nuxt.js
CVE-2026-63671
8.1HIGH
What is CVE-2026-63671?
The MDC tool in Nuxt.js, prior to version 0.22.1, contains a vulnerability that allows dangerous HTML to bypass sanitization. This occurs due to the use of parseMarkdown with the allowDangerousHtml option enabled by default. The sanitizer's validateProp only checks href or src attributes, leaving an SVG xlink:href value with a javascript: URL vulnerable to execution. Additionally, the security mechanism fails to block data:text/html iframes, leading to potential script execution in untrusted Markdown. The vulnerability was resolved in version 0.22.1, emphasizing the importance of updating to safeguard against these exploits.
Affected Version(s)
mdc < 0.22.1