CVE-2026-53427 Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute
Attackers can inject arbitrary JavaScript via Markdown code fences when specific rendering options are enabled, leading to session theft and account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-53427?
CVE-2026-53427 is a low-severity cross-site scripting vulnerability in leandrocp mdex, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.
When syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence's highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line <div>. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as '"><script>alert(1)</script>' terminates the class attribute early and the markup that follows is emitted as live HTML.
An attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.
The vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched.
This issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.
Weakness: CWE-79
Which versions are affected by CVE-2026-53427?
2 open source packages ship an affected version, including mdex and mdex_native.
| Package | Affected | Fixed in |
|---|---|---|
mdex Hex | From 0.11.3 | 0.12.3 |
mdex_native Hex | From 0.1.0 | 0.2.3 |
How do I fix CVE-2026-53427?
Upgrade mdex to 0.12.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-53427 being exploited?
There is no known exploitation of CVE-2026-53427 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-53427, GHSA-v664-pmxr-mxxx.