CVE-2026-63671: Nuxt MDC XSS Vulnerability

CVE-2026-63671 Overview

CVE-2026-63671 is a cross-site scripting (XSS) vulnerability [CWE-79] in the @nuxtjs/mdc package, a Markdown component tool for Vue applications. The sanitizer in versions prior to 0.22.1 fails to strip executable URLs from two attack paths. An SVG xlink:href attribute (represented as xLinkHref) can retain a javascript: URL, and an iframe src attribute can carry a data:text/html payload that survives protocol comparison. Both paths allow script execution when rendered content is loaded by a victim. The maintainers fixed the issue in version 0.22.1.

Critical Impact
Attackers can inject javascript: and data:text/html payloads through crafted Markdown, executing code in the page origin or an opaque origin when a user interacts with rendered content.

Affected Products

@nuxtjs/mdc versions prior to 0.22.1
Nuxt Content applications that render untrusted Markdown through MDC
Vue-based sites using MDC parseMarkdown with allowDangerousHtml enabled

Discovery Timeline

2026-09-16 - CVE-2026-63671 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-63671

Vulnerability Analysis

The @nuxtjs/mdc package parses Markdown with allowDangerousHtml enabled by default. It relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from attacker-controlled Markdown. Two sibling gaps in the sanitizer allow script execution.

The first gap involves attribute coverage. validateProp inspects only attributes named href or src. SVG elements accept xlink:href, which the parser normalizes to xLinkHref. The sanitizer skips this name, so a javascript: URL supplied through xLinkHref reaches the DOM and executes in the page origin when the user activates the element.

The second gap involves protocol comparison. The data:text/html denylist entries are compared against url.protocol, which returns only data:. An iframe src containing data:text/html,<script>...</script> matches nothing in the denylist and renders in an opaque origin. Plain href javascript: URLs, srcdoc, object, script, and base elements are already blocked.

Root Cause

The sanitizer uses an allowlist of attribute names and a mismatched comparison target for URL schemes. validateProp never evaluates xLinkHref, and the denylist checks url.protocol instead of url.href, missing the MIME suffix that carries the payload.

Attack Vector

An attacker submits Markdown containing an SVG element with xlink:href="javascript:..." or an iframe with src="data:text/html,...". When a victim views the rendered document, the payload executes with access to session cookies, tokens, and DOM state in the affected origin. Exploitation requires user interaction to load or activate the malicious element.

typescript

// Patch in src/runtime/parser/utils/props.ts
       return true
     }
 
-    if (unsafeLinkPrefix.some(prefix => url.protocol.toLowerCase().startsWith(prefix))) {
+    if (unsafeLinkPrefix.some(prefix => url.href.toLowerCase().startsWith(prefix))) {
       return false
     }
   }
// Source: https://github.com/nuxt-content/mdc/commit/61d636c2983f021288e4fc5c4006733b38cf0d53

The patch changes the comparison target from url.protocol to url.href, so the denylist matches the full URL including data:text/html prefixes. The companion change extends attribute validation to xLinkHref.

Detection Methods for CVE-2026-63671

Indicators of Compromise

Rendered pages containing <svg> or <use> elements with xlink:href values that start with javascript:
Iframe elements whose src attributes begin with data:text/html in stored Markdown content
Unexpected outbound requests or DOM modifications originating from Markdown-rendered views

Detection Strategies

Scan Markdown stores and content databases for the substrings xlink:href="javascript: and src="data:text/html
Inventory application dependencies for @nuxtjs/mdc versions below 0.22.1 using package manifests and lockfiles
Deploy Content Security Policy (CSP) reports to capture blocked inline script execution attempts on Markdown-rendered routes

Monitoring Recommendations

Log all Markdown submissions from unauthenticated or low-trust users for post-hoc review
Alert on CSP violation reports referencing javascript: navigations or data: iframes
Monitor web application firewall (WAF) telemetry for Markdown payloads containing xlink:href and data:text/html patterns

How to Mitigate CVE-2026-63671

Immediate Actions Required

Upgrade @nuxtjs/mdc to version 0.22.1 or later across all Nuxt Content deployments
Audit stored Markdown content for existing payloads that abuse xlink:href or data:text/html iframes
Enforce a strict Content Security Policy that blocks inline scripts and restricts iframe sources

Patch Information

The maintainers released the fix in @nuxtjs/mdc version 0.22.1. Details are available in the GitHub Security Advisory GHSA-mxm6-v9r6-r94c, the remediation commit, the pull request discussion, and the v0.22.1 release notes.

Workarounds

Disable allowDangerousHtml in parseMarkdown calls where inline HTML is not required
Reject or preprocess Markdown submissions to strip xlink:href and data: URIs before passing content to MDC
Apply a CSP with frame-src 'self' and script-src directives that block inline and data: execution

bash

# Upgrade the affected package
npm install @nuxtjs/mdc@^0.22.1

# Verify installed version
npm ls @nuxtjs/mdc