CVE-2026-53427

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-53427

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53427.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-53427

Aliases

EEF-CVE-2026-53427
GHSA-v664-pmxr-mxxx

Published

2026-06-29T18:50:17Z

Modified

2026-08-12T03:51:28Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute

Details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.

When syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence's highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line

. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as '">' terminates the class attribute early and the markup that follows is emitted as live HTML.

An attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.

The vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched.

This issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.

Database specific

{
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53427.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0d7ffc84ea742e1daf666426814e5bb6d0499433"
                },
                {
                    "fixed": "6ed94d905f97af188323f042698ae841c02293b4"
                },
                {
                    "introduced": "956528c5e31746253347029e810a969ab916fd27"
                },
                {
                    "fixed": "798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/leandrocp/mdex

Affected ranges

Type

GIT

Repo

https://github.com/leandrocp/mdex

Events

Introduced

6330432e88e75bf98eb91546a5aef13dffd637bb

Fixed

2cb9eb2f6014414b40c8f1e5d5181b9692626c38

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.11.3"
        },
        {
            "fixed": "0.12.3"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Type

GIT

Repo

https://github.com/leandrocp/mdex_native

Events

Introduced

Fixed

b6caf84e9dd035654ed7e8955086ab37afdaa7a0

Fixed

798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "fixed": "0.2.3"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.1.5

v0.11.3

v0.11.4

v0.11.5

v0.11.6

v0.11.7

v0.12.0

v0.12.1

v0.12.2

v0.2.0

v0.2.1

v0.2.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53427.json"