VULNRABLE / Vulnerability / CVE-2026-63671
CVE-2026-63671
HIGH LOW @nuxtjs/mdc GHSA
Exploit verdict: No active-exploit signal
CVSS Score
8
Severity
HIGH
EPSS
—
Source
GHSA
Summary
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
What this means
CVE-2026-63671 is a high-severity vulnerability affecting @nuxtjs/mdc, rated CVSS 8. Published September 17, 2026.
View full advisory at GHSA →