Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
@nuxtjs/mdc renders untrusted markdown (including raw HTML) to a Vue component tree. Across two prior advisories it added a URL/attribute sanitizer to block dangerous links in that HTML: validateProps / validateProp and an unsafeLinkPrefix deny-list (dist/runtime/parser/utils/props.js). The sanitizer runs at parse time (dist/runtime/parser/compiler.js) and parseMarkdown enables raw HTML by default (allowDangerousHtml: true, dist/runtime/parser/options.js), so the sanitizer is the only barrier and it applies with no configuration required. Two sibling vectors bypass that sanitizer at the default configuration: 1. SVG anchor xlink:href. validateProp only scheme-checks attributes named exactly href or src: An xlink:href (parsed to the hast property xLinkHref) is neither, so a javascript: URL on an SVG <a is passed through. The renderer maps the property back to the real attribute (MDCRenderer.vue: find(html, "xLinkHref").attribute is xlink:href), so the output element is <a…
Recommended action: Upgrade to 0.22.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A remote script-inclusion / stored XSS vulnerability in @nuxtjs/mdc lets a Markdown author inject a <base href="https://attacker.tld" element. The <base tag rewrites how all subsequent relative URLs are resolved, so an attacker can make the page load scripts, styles, or images from an external, attacker-controlled origin and execute arbitrary JavaScript in the site’s context. Details - Affected file : src/runtime/parser/utils/props.ts - Core logic : validateProp() inspects attributes that start with on → blocked href or src → filtered by isAnchorLinkAllowed() Every other attribute and every tag (including <base) is allowed unchanged, so the malicious href on <base is never validated. As soon as <base href="https://vozec.fr" is parsed, any later relative path—/script.js, ../img.png, etc.—is fetched from the attacker’s domain. Proof of Concept Place the following in any Markdown handled by Nuxt MDC: 1. Start the Nuxt app (npm run dev). 2. Visit the page. 3. The browser requests…
Recommended action: Upgrade to 0.17.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the javascript: protocol scheme in the URL. Details The parsing logic implement at https://github.com/nuxt-modules/mdc/blob/main/src/runtime/parser/utils/props.ts#L16 maintains a deny-list approach to filtering potential malicious payload. It does so by matching protocol schemes like javascript: and others. Specifically, this is the code from the mdc library's parser that is not secure enough: These security guards can be bypassed by an adversarial that provides JavaScript URLs with HTML entities encoded via hex string. PoC The following URL payloads if provided to the markdown parsing library (such as through the usage of import { parseMarkdown } from '@nuxtjs/mdc/runtime';) will trigger the alert() dialog: Impact Users who consume this library and perform markdown parsing from unvalidated sources such as LLM generative text responses, user…
Recommended action: Upgrade to 0.13.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.