Is CVE-2025-24981 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-24981 being exploited in the wild.

How severe is CVE-2025-24981?

Low severity, with a CVSS score of 3.1, published 6 February 2025.

Which products and versions are affected?

@nuxtjs/mdc (npm) SEMVER:introduced=0,fixed=0.13.3.

Is there a fix for CVE-2025-24981?

Yes. @nuxtjs/mdc (npm): upgrade to 0.13.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-24981 attacked?

It is attacked over the network.

Am I affected by CVE-2025-24981?

Check whether you run @nuxtjs/mdc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-24981: Nuxt Markdown Components XSS in parseMarkdown via HTML entity bypass

CVE-2025-24981 · Severity: low · CVSS 3.1 · Published 2025-02-06

@nuxtjs/mdc is a Nuxt module that parses Markdown content into HTML. The library fails to properly filter dangerous JavaScript URLs in anchor links, allowing attackers to inject malicious code by using HTML entity encoding to bypass security checks. Applications that process untrusted Markdown (from user input, LLM outputs, or external sources) can be exploited to execute arbitrary JavaScript in users' browsers, potentially stealing credentials or performing unauthorized actions.

Technologies: @nuxtjs/mdc (npm). Vendors: npm.

Quick answers

Is CVE-2025-24981 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-24981 being exploited in the wild.
How severe is CVE-2025-24981?: Low severity, with a CVSS score of 3.1, published 6 February 2025.
Which products and versions are affected?: @nuxtjs/mdc (npm) SEMVER:introduced=0,fixed=0.13.3.
Is there a fix for CVE-2025-24981?: Yes. @nuxtjs/mdc (npm): upgrade to 0.13.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-24981 attacked?: It is attacked over the network.
Am I affected by CVE-2025-24981?: Check whether you run @nuxtjs/mdc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@nuxtjs/mdc (npm): upgrade to 0.13.3 or later
```
npm install @nuxtjs/mdc@0.13.3
```

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the URL validation logic within @nuxtjs/mdc's parser (props.ts). The parseMarkdown function maintains a deny-list of unsafe URL protocols (javascript:, data:, vbscript:) and checks whether a URL starts with these prefixes using lowercase comparison. However, the check fails when URLs contain HTML entity-encoded characters (such as 	, 
, or 
) within the protocol scheme, allowing payloads like "jav	ascript:" to bypass the filter and execute arbitrary JavaScript. Attack requires no authentication or user interaction beyond rendering malicious Markdown; any application parsing untrusted Markdown via parseMarkdown is at risk. The fix is available in version 0.13.3 and later.

Affected products

Nuxt @nuxtjs/mdc <= 0.13.2

Identifiers

CVE-2025-24981
GHSA-j82m-pc2v-2484

Timeline

2025-02-06: disclosed: GHSA-j82m-pc2v-2484 published
2025-02-06: patched: Fixed in version 0.13.3

References

https://github.com/nuxt-modules/mdc/security/advisories/GHSA-j82m-pc2v-2484

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.