XSS Sanitizer Bypass in @nuxtjs/mdc via SVG xlink:href and data:text/html

What happened

@nuxtjs/mdc parses Markdown with allowDangerousHtml enabled by default and relies on sanitization functions (validateProps, validateProp, and unsafeLinkPrefix) to strip executable URLs from untrusted Markdown before rendering. Two specific gaps were found in this sanitization logic that allow malicious content to slip through and execute in the browser.

Technical cause

The sanitizer has two sibling gaps. First, validateProp only checks attributes literally named href or src, but an SVG attribute written as xLinkHref (representing xlink:href) is not checked, allowing a javascript: URL in that attribute to execute in the page's own origin when the element is interacted with. Second, the denylist for data:text/html values compares only against the URL's protocol component, which is simply data:. This means an iframe with a src of data:text/html survives sanitization entirely and executes when the iframe loads, running in an opaque origin. Other dangerous constructs — plain href javascript: URLs, srcdoc, object, script, and base elements — are already correctly blocked by the existing sanitizer; these two paths are narrow, specific exceptions.

Why it matters

Any application that renders Markdown from untrusted or user-supplied sources using @nuxtjs/mdc with default settings is exposed to script execution in the browser. This can lead to session hijacking, credential theft, or other actions performed in the security context of a logged-in user, depending on how the rendered content is displayed and what privileges the viewing user holds.

Who is affected

Any project using the @nuxtjs/mdc npm package to render Markdown from untrusted sources, prior to version 0.22.1, is affected. Risk is concentrated in applications that accept Markdown input from users or external sources and render it with the default allowDangerousHtml configuration.

Affected versions

All versions of @nuxtjs/mdc prior to 0.22.1 are affected.

Fixes and mitigation

The issue is fixed in @nuxtjs/mdc version 0.22.1. Projects using this package should update to this version or later.

Recommended action

Update @nuxtjs/mdc to version 0.22.1. If immediate updating is not possible, consider disabling allowDangerousHtml for untrusted Markdown sources and apply additional output sanitization as a temporary mitigation until the update can be applied.