Executive brief
@nuxtjs/mdc is a Markdown content component library for Nuxt that processes untrusted markdown (including raw HTML) and converts it to Vue components. A security flaw in its URL sanitizer allows attackers to inject malicious scripts through two separate mechanisms: SVG anchor links with javascript: URLs and embedded iframes with data: URIs. An attacker can craft malicious markdown that, when processed by the library, will execute arbitrary JavaScript in the application's origin, potentially stealing user sessions, credentials, or sensitive data.
Technical details
The vulnerability stems from two distinct gaps in @nuxtjs/mdc's `validateProp` function and `isAnchorLinkAllowed` URL scheme checker. First, the attribute-name check only sanitizes `href` and `src` properties, missing SVG's `xlink:href` attribute which the HAST renderer then maps back to the real XML attribute. An `<a xlink:href="javascript:...">` element passes through the sanitizer and is clickable in the browser. Second, the MIME-type deny-list for data URIs compares against `url.protocol` (which is always just `"data:"` for any data URI) rather than the full URL, so `"data:".startsWith("data:text/html")` always fails; this makes `<iframe src="data:text/html,<script>...</script>">` pass through even though `data:text/html` is in the deny-list. Both vectors are network-reachable at default configuration without authentication; exploitation requires user interaction (click for SVG link, page load for iframe). Patch 0.22.1 is available.
Affected products
- nuxt-content @nuxtjs/mdc < 0.22.1
Timeline
- 2026-07-02: disclosed
- 2026-07-02: patched: Version 0.22.1 released
- 2026-09-16: advisory