Executive brief
next-mdx-remote is a React library that renders Markdown with embedded JSX (MDX) on the server side. The library's serialize function fails to properly sanitize untrusted MDX content, allowing attackers to execute arbitrary code during server-side rendering. This could give an attacker complete control over the web server and access to sensitive data.
Technical details
The vulnerability is an arbitrary code execution flaw (CWE-94) in the serialize function used to compile MDX content. The root cause is insufficient sanitization of user-supplied MDX input before compilation and execution during React server-side rendering. An attacker can inject malicious code into MDX content that will be executed with the privileges of the server process. The attack requires that the application passes untrusted/user-controlled MDX content to the serialize function; no authentication is required from a user perspective if the MDX is embedded in a public page. The vulnerability affects versions 4.3.0 through 5.x, and has been fixed in version 6.0.0 released in February 2026.
Affected products
- HashiCorp next-mdx-remote 4.3.0 to 5.x
Timeline
- 2026-02-12: disclosed
- 2026-02-12: patched: Fixed in version 6.0.0