Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

mdex

6 known vulnerabilities (1 high, 4 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 1 high, 4 medium, 1 low
Registry
Hex

Advisories 6

  • Atom-table exhaustion denial-of-service via JSON parse_document in MDEx

    Affected: from 0.4.3, fixed in 0.13.2; from 0.4.3, fixed in 0.13.2.

  • CVE-2026-54889Medium 5.1

    Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)

    Affected: from 0.8.3, fixed in 0.13.2; from 0.8.3, fixed in 0.13.2.

  • CVE-2026-54888Medium 6.9

    Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex

    Affected: from 0.3.0, fixed in 0.12.3; from 0.3.0, fixed in 0.12.3.

  • CVE-2026-53429Medium 6.9

    Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service

    Affected: from 0.11.0, fixed in 0.12.3; from 0.11.0, fixed in 0.12.3.

  • CVE-2026-53428Medium 6.9

    Unbounded memory allocation in highlight_lines range expansion in mdex

    Affected: from 0.11.0, fixed in 0.12.3; from 0.11.0, fixed in 0.12.3.

  • Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute

    Affected: from 0.11.3, fixed in 0.12.3; from 0.11.3, fixed in 0.12.3.