{"items":[{"id":"NVI-00014061","kind":"vulnerability","title":"@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-mxm6-v9r6-r94c","CVE-2026-63671"],"plain_summary":"GitHub lists this reviewed advisory for @nuxtjs/mdc. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-3b111c1b1713e6bda95ee8fda4c82267"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-16T22:14:03.000Z","value":"8.1 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-3b111c1b1713e6bda95ee8fda4c82267"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3b111c1b1713e6bda95ee8fda4c82267","url":"https://github.com/advisories/GHSA-mxm6-v9r6-r94c","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-mxm6-v9r6-r94c","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T19:09:30.244Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3b111c1b1713e6bda95ee8fda4c82267"],"technology":"@nuxtjs/mdc","known_exclusions":[],"conditions_summary":"## Summary\n\n`@nuxtjs/mdc` renders untrusted markdown (including raw HTML) to a Vue component tree. Across two prior advisories it added a URL/attribute sanitizer to block dangerous links in that HTML: `validateProps` / `validateProp` and an `unsafeLinkPrefix` deny-list (`dist/runtime/parser/utils/props.js`). The sanitizer runs at parse time (`dist/runtime/parser/compiler.js`) and `parseMarkdown` enables raw HTML by default (`allowDangerousHtml: true`, `dist/runtime/parser/options.js`), so the sanitizer is the only barrier and it applies with no configuration required.\n\nTwo sibling vectors bypass that sanitizer at the default configuration:\n\n1. SVG anchor `xlink:href`. `validateProp` only scheme-checks attributes named exactly `href` or `src`:\n\n   ```\n   if (attribute === \"href\" || attribute === \"src\") return isAnchorLinkAllowed(value);\n   return true;\n   ```\n\n   An `xlink:href` (parsed to the hast property `xLinkHref`) is neither, so a `javascript:` URL on an SVG `` is passed through. The renderer maps the property back to the real attribute (`MDCRenderer.vue`: `find(html, \"xLinkHref\").attribute` is `xlink:href`), so the output element is ``. Click","public_affected_ranges":["< 0.22.1"]}],"null_published_at":"2026-11-02T10:00:37.202Z","source_updated_at":"2026-09-16T22:14:03.000Z","source_disclosed_at":"2026-09-16T22:14:01.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T19:09:30.244Z"}],"next_cursor":null,"snapshot_revision":"42594"}