# CVE-2026-63671: @nuxtjs/mdc URL sanitizer bypass via SVG xlink:href and data: iframe

Source: https://junglewise.ai/threats/cve-2026-63671-nuxtjs-mdc-url-sanitizer-bypass-via-svg-xlink-href-and-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-63671 · Severity: high · CVSS 8.1 · Published 2026-09-16

@nuxtjs/mdc is a Markdown content component library for Nuxt that processes untrusted markdown (including raw HTML) and converts it to Vue components. A security flaw in its URL sanitizer allows attackers to inject malicious scripts through two separate mechanisms: SVG anchor links with javascript: URLs and embedded iframes with data: URIs. An attacker can craft malicious markdown that, when processed by the library, will execute arbitrary JavaScript in the application's origin, potentially stealing user sessions, credentials, or sensitive data.

Technologies: [@nuxtjs/mdc (npm)](https://junglewise.ai/threats/technologies/nuxtjs-mdc). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Nuxt](https://junglewise.ai/threats/vendors/nuxt).

## Quick answers

**Is CVE-2026-63671 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63671 being exploited in the wild.

**How severe is CVE-2026-63671?** High severity, with a CVSS score of 8.1, published 16 September 2026.

**Which products and versions are affected?** @nuxtjs/mdc (npm) < 0.22.1, SEMVER:introduced=0,fixed=0.22.1; Nuxt MDC < 0.22.1.

**Is there a fix for CVE-2026-63671?** Yes. @nuxtjs/mdc (npm): upgrade to 0.22.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63671 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63671?** Check whether you run @nuxtjs/mdc (npm) or Nuxt MDC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @nuxtjs/mdc (npm): upgrade to 0.22.1 or later

  ```sh
  npm install @nuxtjs/mdc@0.22.1
  ```


## Technical details

The vulnerability stems from two distinct gaps in @nuxtjs/mdc's `validateProp` function and `isAnchorLinkAllowed` URL scheme checker. First, the attribute-name check only sanitizes `href` and `src` properties, missing SVG's `xlink:href` attribute which the HAST renderer then maps back to the real XML attribute. An `<a xlink:href="javascript:...">` element passes through the sanitizer and is clickable in the browser. Second, the MIME-type deny-list for data URIs compares against `url.protocol` (which is always just `"data:"` for any data URI) rather than the full URL, so `"data:".startsWith("data:text/html")` always fails; this makes `<iframe src="data:text/html,<script>...</script>">` pass through even though `data:text/html` is in the deny-list. Both vectors are network-reachable at default configuration without authentication; exploitation requires user interaction (click for SVG link, page load for iframe). Patch 0.22.1 is available.

## Affected products

- nuxt-content @nuxtjs/mdc < 0.22.1

## Identifiers

- CVE-2026-63671
- GHSA-mxm6-v9r6-r94c

## Timeline

- 2026-07-02: disclosed
- 2026-07-02: patched: Version 0.22.1 released
- 2026-09-16: advisory

## References

- [https://api.github.com/users/rz1027](https://api.github.com/users/rz1027)
- [https://github.com/rz1027](https://github.com/rz1027)
- [https://api.github.com/users/rz1027/gists%7B/gist_id%7D](https://api.github.com/users/rz1027/gists%7B/gist_id%7D)
- [https://api.github.com/users/rz1027/repos](https://api.github.com/users/rz1027/repos)
- [https://avatars.githubusercontent.com/u/53318196?v=4](https://avatars.githubusercontent.com/u/53318196?v=4)
- [https://api.github.com/users/rz1027/events%7B/privacy%7D](https://api.github.com/users/rz1027/events%7B/privacy%7D)

## Related threats

- [Nuxt MDC stored XSS in markdown rendering via base tag](https://junglewise.ai/threats/cve-2025-54075-nuxt-mdc-stored-xss-in-markdown-rendering-via-base-tag)
- [Nuxt Markdown Components XSS in parseMarkdown via HTML entity bypass](https://junglewise.ai/threats/cve-2025-24981-nuxt-markdown-components-xss-in-parsemarkdown-via-html-entity)