CVE-2026-63671: Cross-Site Scripting (XSS) Sanitizer Bypass in @nuxtjs/mdc

The @nuxtjs/mdc (Markdown Components) library is a core framework component within the Nuxt content ecosystem. It parses Markdown documents into a Hypertext Abstract Syntax Tree (HAST) and renders them as interactive Vue components. By design, this package supports rich content rendering, including raw HTML processing when configured with default parameters.

This analysis examines CVE-2026-63671, a critical cross-site scripting (XSS) vulnerability residing within the parsing utility layer of @nuxtjs/mdc prior to version 0.22.1. The vulnerability emerges from gaps in the attribute sanitization mechanism, which is designed to identify and neutralize malicious URIs.

The vulnerability allows remote, unauthenticated attackers to bypass default security filters by supplying crafted Markdown elements. Specifically, the sanitizer fails to intercept SVG-specific hyperlink attributes and misinterprets standard URL protocol definitions for data URIs. This results in the insertion of executable scripts directly into the DOM of the rendering web application.

The primary failure mechanism involves the sanitizer implementation found in src/runtime/parser/utils/props.ts. The implementation defines a validation gatekeeper via the validateProp function. This function restricts security checks to an explicit allowlist of properties, specifically looking for exact matches of href and src.

When the HAST parser processes Scalable Vector Graphics (SVG) structures, it translates XML attributes into standardized Javascript representations. The standard SVG attribute xlink:href is converted into camelCase or lowercase equivalents such as xLinkHref or xlinkhref. Because the pre-patch logic only verified href and src, the xlinkhref attribute bypassed validation entirely and passed raw javascript: payloads straight to the renderer.

The second logical error resides in the isAnchorLinkAllowed function, which determines whether a URI protocol is safe. The parser evaluated incoming strings using a denylist of protocols, checking if url.protocol starts with elements from unsafeLinkPrefix, which included data:text/html. However, standard Web API URL parsing rules resolve the protocol property of any data URI strictly to the string data:.

Consequently, executing url.protocol.startsWith('data:text/html') evaluated to false because 'data:' does not start with 'data:text/html'. This logic flaw allowed arbitrary data-encoded payload delivery using the data:text/html media type. The vulnerability constitutes an incomplete input validation weakness classified under CWE-184 and CWE-79.

The logic within src/runtime/parser/utils/props.ts can be analyzed to understand the precise mechanics of the security patch. The pre-patch validation structure relied on strict string equality checks against a limited subset of HTML attributes, leaving SVG specifications unprotected.

Below is a comparison highlighting the changes implemented in the official patch:

// PRE-PATCH IMPLEMENTATION
export const validateProp = (attribute: string, value: string) => {
  if (attribute === 'href' || attribute === 'src') {
    return isAnchorLinkAllowed(value)
  }
}
 
function isAnchorLinkAllowed(value: string) {
  // ...
  if (unsafeLinkPrefix.some(prefix => url.protocol.toLowerCase().startsWith(prefix))) {
    return false
  }
  // ...
}

The remediation, introduced in commit 61d636c2983f021288e4fc5c4006733b38cf0d53, modified the validation scope and structural validation rules:

// POST-PATCH IMPLEMENTATION
export const validateProp = (attribute: string, value: string) => {
  // Added explicit validation for 'xlinkhref' to cover SVG hyperlinks
  if (attribute === 'href' || attribute === 'src' || attribute === 'xlinkhref') {
    return isAnchorLinkAllowed(value)
  }
}
 
function isAnchorLinkAllowed(value: string) {
  // ...
  // Changed verification from 'url.protocol' to the full serialized 'url.href'
  if (unsafeLinkPrefix.some(prefix => url.href.toLowerCase().startsWith(prefix))) {
    return false
  }
  // ...
}

The patch replaces the protocol checking mechanism with a prefix match against the fully qualified URL string (url.href). This guarantees that string sequences matching data:text/html are correctly blocked. Additionally, explicit support for matching the xlinkhref attribute was introduced to cover the vulnerability in SVG elements.

Exploitation of CVE-2026-63671 requires feeding a malicious Markdown payload to the @nuxtjs/mdc parser. The parser must render the input inside an application context where HTML rendering is active.

The attack path is visualized below:

To execute the SVG vector, the attacker provides a nested SVG element inside the markdown payload. When parsed, this bypasses the standard href validation gate and places a dangerous link in the browser DOM.

<svg viewBox="0 0 10 10">
  <a xlink:href="javascript:alert(document.domain)">click here</a>
</svg>

Alternatively, the attacker can leverage the iframe vector to deliver an interactive payload that runs in a nested context. The validator processes the src attribute but fails to identify the data protocol bypass.

<iframe src="data:text/html,<script>alert(document.cookie)</script>"></iframe>

The execution of arbitrary script content within the context of a victim session yields severe consequences. Because @nuxtjs/mdc renders content directly into the host Nuxt application, an injected script executes with the full privileges of the application origin.

Attackers can capture sensitive session variables, access local storage or session storage tokens, and hijack active application sessions. In environments handling authenticated transactions, this vulnerability permits unauthenticated state changes on behalf of the user.

The CVSS v3.1 score of 8.1 reflects a high threat profile. Since exploitation requires minimal user interaction and low complexity, automated exploits can be deployed via malicious markdown uploads or comment fields.

The primary mitigation step is updating @nuxtjs/mdc to version 0.22.1 or later. This upgrade addresses both the SVG attribute parsing gap and the data protocol verification failure.

Applications that cannot immediately deploy the dependency update should disable rendering of dangerous inline HTML. This can be achieved by setting the allowDangerousHtml option to false in the markdown parser configuration interface.

Furthermore, security teams should implement a Content Security Policy (CSP) to mitigate downstream impact. A robust CSP restricting script-src directives prevents the execution of inline scripts and unauthorized data URIs even if a sanitizer bypass occurs.