Executive brief
A vulnerability in the MDEx Markdown library for Elixir could allow attackers to execute malicious scripts in a user's browser. This occurs when the library processes Markdown containing specially crafted links and converts them into a format used by web editors. If an end-user clicks on one of these malicious links, it could lead to unauthorized actions or the theft of sensitive information like session cookies.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the 'Elixir.MDEx.DeltaConverter' module of the mdex library. The 'default_convert_node/3' function fails to sanitize or validate URL schemes when processing links, wikilinks, or images, allowing 'javascript:' URIs to be passed directly into the Quill Delta output. When this output is subsequently rendered into HTML by a downstream component (like a Quill client), the malicious URI is placed into 'href' or 'src' attributes. An attacker can exploit this by providing malicious Markdown that, when viewed and interacted with by a user, executes arbitrary JavaScript in the context of the user's session. The issue is fixed in version 0.13.2, which introduces default URL filtering.
Affected products
- leandrocp mdex 0.8.3 to 0.13.1
Timeline
- 2026-06-29: disclosed
- 2026-06-29: patched: Fixed in version 0.13.2
- 2026-06-29: advisory