CVE-2026-54889: mdex Elixir Library XSS Vulnerability

CVE-2026-54889 Overview

CVE-2026-54889 is a cross-site scripting (XSS) vulnerability in the mdex library by leandrocp, an Elixir Markdown processor. The flaw resides in the Quill Delta conversion path, where Elixir.MDEx.DeltaConverter:default_convert_node/3 copies link, wikilink, and image URLs directly from parsed Markdown into Delta attributes without a scheme allowlist or normalization. Attackers who control Markdown input can inject javascript: URLs that survive verbatim into the Delta output. When downstream renderers such as quill-delta-to-html or the Quill client convert the Delta to HTML, the malicious URL becomes an <a href> attribute, executing arbitrary script in the victim's browser on click. The issue affects mdex from version 0.8.3 before 0.13.2.

Critical Impact
Attackers controlling Markdown input can execute arbitrary JavaScript in the browsers of users viewing rendered Delta content, enabling session theft, credential harvesting, and account takeover.

Affected Products

leandrocp mdex versions 0.8.3 through 0.13.1
Applications using MDEx.to_delta/2 for Markdown-to-Quill Delta conversion
Downstream renderers consuming Delta output (quill-delta-to-html, Quill client)

Discovery Timeline

2026-06-29 - CVE-2026-54889 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-54889

Vulnerability Analysis

The mdex library provides MDEx.to_delta/2 to convert Markdown documents into Quill Delta format, a JSON structure used by the Quill rich-text editor. The Delta conversion logic in lib/mdex/delta_converter.ex handles link, wikilink, and image nodes by copying the URL string directly into the Delta link or image attribute. No scheme validation, allowlist enforcement, or URL normalization is performed at this stage.

An attacker supplying Markdown such as [click](javascript:alert(document.cookie)) produces a Delta operation with link: "javascript:alert(document.cookie)". When downstream tooling renders this Delta to HTML, the javascript: scheme becomes an active href, executing script in the viewer's browser on click. The link and wikilink vectors are the strongest exploitation paths. Image nodes are lower impact because modern browsers block javascript: execution in <img src> attributes.

Root Cause

The root cause is missing input sanitization at the Delta conversion boundary [CWE-79]. The default_convert_node/3 function trusts URL content from parsed Markdown AST nodes without applying a scheme allowlist (such as http, https, mailto) or rejecting dangerous schemes like javascript:, data:, and vbscript:.

Attack Vector

Exploitation requires an attacker to submit Markdown content that is later rendered for other users. Common attack surfaces include comment systems, collaborative editors, wikis, and any application accepting user-supplied Markdown that feeds into a Quill-based rendering pipeline. The victim must interact with the malicious link for the payload to execute.

text

// Patch: lib/mdex.ex - fix(delta): omit dangerous URL by default
// Note: Block-level attributes are applied to newline characters (`\n`) following Quill Delta conventions.
// Inline attributes are applied directly to text content. Multiple attributes can be combined (e.g., bold + italic).
+
+ Dangerous link, wikilink, and image URLs are rendered as empty strings by default,
+ pass `render: [unsafe: true]` only for trusted input if you need to preserve those URLs.
+
// Patch: lib/mdex/delta_converter.ex
  @typedoc "Conversion options"
  @type options :: keyword()

+ @omitted_url ""
+
  @doc """
  Convert an MDEx document to Quill Delta format.

Source: GitHub Commit 2817147

Detection Methods for CVE-2026-54889

Indicators of Compromise

Markdown submissions containing javascript:, data:, or vbscript: URL schemes in link, wikilink, or image syntax
Quill Delta payloads with link or image attribute values beginning with non-http(s) schemes
Rendered HTML containing <a href="javascript:..."> originating from user-generated Markdown
Application logs showing MDEx.to_delta/2 invocations against untrusted input on mdex versions 0.8.3 through 0.13.1

Detection Strategies

Scan application dependencies for mdex versions between 0.8.3 and 0.13.1 using mix deps or software composition analysis tooling
Inspect stored Markdown content and Delta JSON records for URL fields containing dangerous schemes
Deploy a web application firewall rule matching javascript: inside Markdown link syntax on user input endpoints

Monitoring Recommendations

Log and alert on Content Security Policy (CSP) violations reporting inline script execution from rendered Markdown output
Monitor authentication events for anomalous session activity following user interaction with Markdown-rendered content
Audit outbound requests from browser sessions that could indicate cookie or token exfiltration

How to Mitigate CVE-2026-54889

Immediate Actions Required

Upgrade mdex to version 0.13.2 or later in all Elixir applications using MDEx.to_delta/2
Audit stored Markdown and Delta records for existing javascript: payloads and remove or re-sanitize them
Enforce a strict Content Security Policy that blocks inline script execution as a defense-in-depth measure

Patch Information

The fix is available in mdex 0.13.2. The patch introduces an @omitted_url "" constant and replaces dangerous URLs with empty strings by default. Callers who need to preserve non-standard URLs for trusted input must explicitly pass render: [unsafe: true]. See the GitHub Security Advisory GHSA-4383-7xfp-gpph and the remediation commit for details.

Workarounds

Sanitize Delta output before passing it to downstream renderers by rejecting any link or image attribute whose value does not begin with http://, https://, or mailto:
Apply URL scheme filtering at the downstream HTML renderer layer (for example, configure quill-delta-to-html link sanitizers)
Restrict Markdown submission privileges to trusted users until the upgrade is deployed

bash

# Update mdex to the patched release in mix.exs
# {:mdex, "~> 0.13.2"}
mix deps.update mdex
mix deps.get
mix compile