- Latest release
- 0.23.2 (Oct 1, 2026): no advisory affects it
- Newest unaffected release
- 0.23.2 (Oct 1, 2026), the latest release
- Advisories
- 3 · 1 critical, 2 high
- Weekly downloads
- 315.7K
- Dependents
- 79
- Releases
- 75 since 0.1.0 (Aug 28, 2023)
- Registry
- npm
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-63671Affects 0.1.0 to 0.22.0 (0.22.1 is outside it)
- CVE-2025-54075Affects 0.1.0 to 0.17.1 (0.17.2 is outside it)
- CVE-2025-24981Affects 0.1.0 to 0.13.2 (0.13.3 is outside it)
Advisories 3
- CVE-2026-63671High 8.1
@nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
Affected: fixed in 0.22.1.
Fixed in 0.22.1 (released Jul 2, 2026, 76 days before disclosure).
The latest release, 0.23.2, is not affected.
39% of @nuxtjs/mdc downloads last week were affected versions (129.5K).
- CVE-2025-54075High 8.3
mdc vulnerable to XSS in markdown rendering bypassing HTML filter. (N°4)
Affected: fixed in 0.17.2.
Fixed in 0.17.2 (released Jul 18, 2025, the day of disclosure).
The latest release, 0.23.2, is not affected.
13% of @nuxtjs/mdc downloads last week were affected versions (43.1K).
- CVE-2025-24981Critical 9.3
Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc
Affected: fixed in 0.13.3.
Fixed in 0.13.3 (released Feb 6, 2025, the day of disclosure).
The latest release, 0.23.2, is not affected.
8.2% of @nuxtjs/mdc downloads last week were affected versions (27.1K).