CVE-2026-53427

Name of the Vulnerable Software and Affected Versions mdex versions 0.11.3 through 0.12.2 mdex native versions 0.1.0 through 0.2.2

Description Improper neutralization of input during web page generation allows stored or reflected cross-site scripting via attacker-controlled Markdown. When syntax highlighting and full info-string forwarding (render: [full info string: true]) are enabled, the Lumis adapter copies the value of a code fence's highlight lines class info-string attribute unescaped into the class attribute of every rendered line. The comrak nif::lumis adapter::LumisAdapter::parse custom attributes() function shlex-parses the info string and stores key-value pairs verbatim. Subsequently, highlight lines config pulls highlight lines class into the per-line class value, and write highlighted() interpolates that value directly into the class attribute of the per-line <div>. A single-quoted shell token can preserve an inner double quote, allowing an attacker to terminate the class attribute and inject arbitrary HTML and JavaScript. This can lead to session theft and account takeover without requiring authentication or special privileges.

Recommendations Update mdex to version 0.12.3 or later. Update mdex native to version 0.2.3 or later. As a temporary workaround, do not enable full info-string forwarding (render: [full info string: true]) when rendering untrusted Markdown. Restrict highlight lines class values to a safe character set (e.g., [A-Za-z0-9 -]) before rendering.