Executive brief
MDEx is a Markdown processing library used to convert text into HTML for display on websites. A security flaw allows attackers to embed malicious code within Markdown content, such as comments or forum posts. If a user views this content, the attacker could steal login sessions, take over accounts, or perform other unauthorized actions in the user's browser.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the Lumis adapter of MDEx and mdex_native. When syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the library fails to escape the 'highlight_lines_class' attribute from Markdown code fences. The 'parse_custom_attributes' function in 'lumis_adapter.rs' uses shlex-parsing which preserves inner double quotes in single-quoted tokens, allowing an attacker to terminate the HTML class attribute and inject live HTML tags. This can be exploited by any unauthenticated user capable of submitting Markdown content. The issue is fixed in mdex 0.12.3 and mdex_native 0.2.3.
Affected products
- leandrocp mdex 0.11.3 to 0.12.2
- leandrocp mdex_native 0.1.0 to 0.2.2
Timeline
- 2026-06-29: disclosed
- 2026-06-29: advisory