{"vulnerability": "CVE-2026-63671", "sightings": [{"uuid": "a8b6b17e-7f60-4ea9-9007-397245d8cfb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63671", "type": "published-proof-of-concept", "source": "https://github.com/nuxt-content/mdc/security/advisories/GHSA-mxm6-v9r6-r94c", "content": "", "creation_timestamp": "2026-09-17T00:35:04.905832Z"}, {"uuid": "99abd818-4e47-4a12-a410-18a5c43038a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63671", "type": "seen", "source": "https://gist.github.com/alon710/5ecaf58f0525c80ea68a1ae98625c2a7", "content": "# CVE-2026-63671: CVE-2026-63671: Cross-Site Scripting (XSS) Sanitizer Bypass in @nuxtjs/mdc\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63671\n\n## Summary\nA cross-site scripting (XSS) vulnerability was identified in @nuxtjs/mdc prior to version 0.22.1. Gaps in the HTML/SVG attribute verification and URL protocol parsing allow unauthenticated remote attackers to bypass the application's sanitization routines. By embedding malicious SVG links or data-encoded iframe elements within Markdown, attackers can execute arbitrary JavaScript in the victim's browser context.\n\n## TL;DR\nUnauthenticated XSS vulnerability in @nuxtjs/mdc prior to 0.22.1 allows attackers to bypass URL sanitizers and execute arbitrary scripts via crafted SVG xlink:href attributes and data:text/html URIs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79, CWE-184\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.1\n- **Exploit Status**: poc\n- **KEV Status**: Not listed\n- **Impact**: Cross-Site Scripting (XSS)\n\n## Affected Systems\n\n- @nuxtjs/mdc prior to version 0.22.1\n- Nuxt Content projects relying on vulnerable parser dependencies\n- **@nuxtjs/mdc**: < 0.22.1 (Fixed in: `0.22.1`)\n\n## Mitigation\n\n- Upgrade @nuxtjs/mdc to version 0.22.1 or newer\n- Disable raw and dangerous HTML rendering inside markdown parser settings by configuring allowDangerousHtml to false\n- Implement a strong Content Security Policy (CSP) restricting inline script execution and unauthorized data: schemes\n\n**Remediation Steps:**\n1. Identify all project dependencies relying on @nuxtjs/mdc or nuxt-content\n2. Update the dependency using your package manager: npm install @nuxtjs/mdc@latest or pnpm update @nuxtjs/mdc\n3. Audit your markdown processing configurations to ensure unvalidated user inputs do not leverage allowDangerousHtml\n4. Deploy CSP headers restricting script-src elements to verified origins\n\n## References\n\n- [GitHub Security Advisory GHSA-mxm6-v9r6-r94c](https://github.com/nuxt-content/mdc/security/advisories/GHSA-mxm6-v9r6-r94c)\n- [Official Fix Commit](https://github.com/nuxt-content/mdc/commit/61d636c2983f021288e4fc5c4006733b38cf0d53)\n- [Pull Request #491](https://github.com/nuxt-content/mdc/pull/491)\n- [Release Tag v0.22.1](https://github.com/nuxt-content/mdc/releases/tag/v0.22.1)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-63671)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63671) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T01:31:24.272237Z"}]}