Executive brief
@nuxtjs/mdc is a Nuxt module that parses Markdown content into HTML. The library fails to properly filter dangerous JavaScript URLs in anchor links, allowing attackers to inject malicious code by using HTML entity encoding to bypass security checks. Applications that process untrusted Markdown (from user input, LLM outputs, or external sources) can be exploited to execute arbitrary JavaScript in users' browsers, potentially stealing credentials or performing unauthorized actions.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the URL validation logic within @nuxtjs/mdc's parser (props.ts). The parseMarkdown function maintains a deny-list of unsafe URL protocols (javascript:, data:, vbscript:) and checks whether a URL starts with these prefixes using lowercase comparison. However, the check fails when URLs contain HTML entity-encoded characters (such as 	, 
, or ) within the protocol scheme, allowing payloads like "jav	ascript:" to bypass the filter and execute arbitrary JavaScript. Attack requires no authentication or user interaction beyond rendering malicious Markdown; any application parsing untrusted Markdown via parseMarkdown is at risk. The fix is available in version 0.13.3 and later.
Affected products
- Nuxt @nuxtjs/mdc <= 0.13.2
Timeline
- 2025-02-06: disclosed: GHSA-j82m-pc2v-2484 published
- 2025-02-06: patched: Fixed in version 0.13.3