CVE-2026-53427: MDEx Markdown XSS Vulnerability

CVE-2026-53427 Overview

CVE-2026-53427 is a cross-site scripting (XSS) vulnerability [CWE-79] in the leandrocp MDEx Markdown rendering library and its extracted mdex_native package. The flaw lives in the Lumis syntax-highlighting adapter, which copies the highlight_lines_class info-string attribute from a Markdown code fence into the class attribute of every rendered line without HTML escaping. An attacker who can submit Markdown through comments, wiki pages, posts, or any user-generated content can inject arbitrary HTML and JavaScript. The rendered payload executes in the browser of every user who views the output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.

Critical Impact
Attacker-controlled Markdown yields stored or reflected XSS in any application that renders untrusted content with MDEx syntax highlighting and full_info_string: true enabled.

Affected Products

mdex from version 0.11.3 before 0.12.3
mdex_native from version 0.1.0 before 0.2.3
Elixir applications using the Lumis adapter with render: [full_info_string: true]

Discovery Timeline

2026-06-29 - CVE-2026-53427 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-53427

Vulnerability Analysis

The vulnerability resides in the native Rust component of MDEx, specifically comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs. When syntax highlighting is enabled together with full info-string forwarding, the adapter shlex-parses the Markdown code fence info string and stores each key=value pair verbatim. The highlight_lines_config routine then pulls the highlight_lines_class value into the per-line class field. Downstream, write_highlighted interpolates that value directly into the class attribute of the per-line <div> element without HTML escaping.

Root Cause

The root cause is missing output encoding of a user-controllable attribute value before insertion into an HTML attribute context. shlex parsing preserves an inner double quote inside a single-quoted shell token, so a crafted value survives tokenization intact. The rendering pipeline treats the resulting string as safe and writes it verbatim into the DOM, breaking out of the attribute context.

Attack Vector

An attacker submits a Markdown code fence whose info string contains a highlight_lines_class attribute wrapped in single quotes and carrying an embedded double quote followed by HTML markup, for example '"><script>alert(1)</script>'. The double quote terminates the class attribute early, and everything that follows is emitted as live HTML. Because Markdown submission is a common feature of comment systems, forums, wikis, and documentation sites, exploitation requires only the ability to post content. Victims trigger execution simply by viewing the rendered page.

The vulnerable code was later extracted into the separate mdex_native package at native/mdex_native_nif/src/lumis_adapter.rs, where it remained unpatched at disclosure. See the GitHub Security Advisory GHSA-v664-pmxr-mxxx for technical details.

Detection Methods for CVE-2026-53427

Indicators of Compromise

Markdown submissions containing code fences with highlight_lines_class attributes that include quote characters, angle brackets, or <script> tokens.
Rendered HTML output where a <div class="..."> element contains unexpected attribute terminators or inline event handlers.
Application logs showing Markdown documents with unusually long or shell-quoted info strings on fenced code blocks.

Detection Strategies

Inspect stored Markdown content for regex patterns matching highlight_lines_class= followed by quoted values containing <, >, or ".
Instrument the Lumis adapter path to log parsed key/value pairs from parse_custom_attributes and flag values containing HTML metacharacters.
Deploy a Content Security Policy (CSP) report-only rule to surface inline-script violations originating from Markdown-rendered pages.

Monitoring Recommendations

Monitor web server access logs for POST requests to Markdown submission endpoints followed by high-volume GET requests on the rendered page.
Track browser-side CSP violation reports for script-src breaches on paths served by MDEx-backed rendering.
Alert on outbound requests from user browsers to unexpected domains immediately after viewing user-generated Markdown content.

How to Mitigate CVE-2026-53427

Immediate Actions Required

Upgrade mdex to version 0.12.3 or later.
Upgrade mdex_native to version 0.2.3 or later once the fixed release is available.
Audit application configuration for render: [full_info_string: true] and disable it where not required.
Review historical Markdown content for embedded highlight_lines_class payloads and purge or re-render affected records.

Patch Information

The fix is committed in the upstream repository as GitHub commit 798a363. The patch ensures that attribute values parsed from code fence info strings are HTML-escaped before insertion into the rendered class attribute. Additional context is available in the CNA advisory for CVE-2026-53427 and in the OSV entry.

Workarounds

Disable full info-string forwarding by setting render: [full_info_string: false] in MDEx configuration.
Disable Lumis syntax highlighting for untrusted Markdown sources until the upgrade is deployed.
Enforce a strict Content Security Policy that blocks inline scripts and restricts script-src to trusted origins.
Sanitize rendered HTML output through a library such as html_sanitize_ex before returning it to browsers.

bash

# Configuration example: pin patched versions in mix.exs
{:mdex, "~> 0.12.3"}
{:mdex_native, "~> 0.2.3"}