Is CVE-2026-63671 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63671 being exploited in the wild.

How severe is CVE-2026-63671?

High severity, with a CVSS score of 8.1, published 16 September 2026.

Which products and versions are affected?

@nuxtjs/mdc (npm) < 0.22.1, SEMVER:introduced=0,fixed=0.22.1; Nuxt MDC < 0.22.1.

Is there a fix for CVE-2026-63671?

Yes. @nuxtjs/mdc (npm): upgrade to 0.22.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63671 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63671?

Check whether you run @nuxtjs/mdc (npm) or Nuxt MDC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63671: @nuxtjs/mdc URL sanitizer bypass via SVG xlink:href and data: iframe

Q: Which products and versions are affected?

@nuxtjs/mdc (npm) < 0.22.1, SEMVER:introduced=0,fixed=0.22.1; Nuxt MDC < 0.22.1.

Q: Is there a fix for CVE-2026-63671?

Yes. @nuxtjs/mdc (npm): upgrade to 0.22.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-63671 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-63671?

Check whether you run @nuxtjs/mdc (npm) or Nuxt MDC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63671 · Severity: high · CVSS 8.1 · Published 2026-09-16

@nuxtjs/mdc is a Markdown content component library for Nuxt that processes untrusted markdown (including raw HTML) and converts it to Vue components. A security flaw in its URL sanitizer allows attackers to inject malicious scripts through two separate mechanisms: SVG anchor links with javascript: URLs and embedded iframes with data: URIs. An attacker can craft malicious markdown that, when processed by the library, will execute arbitrary JavaScript in the application's origin, potentially stealing user sessions, credentials, or sensitive data.

Technologies: @nuxtjs/mdc (npm). Vendors: npm, Nuxt.

Quick answers

Is CVE-2026-63671 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63671 being exploited in the wild.
How severe is CVE-2026-63671?: High severity, with a CVSS score of 8.1, published 16 September 2026.
Which products and versions are affected?: @nuxtjs/mdc (npm) < 0.22.1, SEMVER:introduced=0,fixed=0.22.1; Nuxt MDC < 0.22.1.
Is there a fix for CVE-2026-63671?: Yes. @nuxtjs/mdc (npm): upgrade to 0.22.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63671 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63671?: Check whether you run @nuxtjs/mdc (npm) or Nuxt MDC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@nuxtjs/mdc (npm): upgrade to 0.22.1 or later
```
npm install @nuxtjs/mdc@0.22.1
```

Technical details

The vulnerability stems from two distinct gaps in @nuxtjs/mdc's `validateProp` function and `isAnchorLinkAllowed` URL scheme checker. First, the attribute-name check only sanitizes `href` and `src` properties, missing SVG's `xlink:href` attribute which the HAST renderer then maps back to the real XML attribute. An `<a xlink:href="javascript:...">` element passes through the sanitizer and is clickable in the browser. Second, the MIME-type deny-list for data URIs compares against `url.protocol` (which is always just `"data:"` for any data URI) rather than the full URL, so `"data:".startsWith("data:text/html")` always fails; this makes `<iframe src="data:text/html,<script>...</script>">` pass through even though `data:text/html` is in the deny-list. Both vectors are network-reachable at default configuration without authentication; exploitation requires user interaction (click for SVG link, page load for iframe). Patch 0.22.1 is available.

Affected products

nuxt-content @nuxtjs/mdc < 0.22.1

Identifiers

CVE-2026-63671
GHSA-mxm6-v9r6-r94c

Timeline

2026-07-02: disclosed
2026-07-02: patched: Version 0.22.1 released
2026-09-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.