CVE-2026-54889

Name of the Vulnerable Software and Affected Versions leandrocp mdex versions 0.8.3 through 0.13.1

Description Improper neutralization of input during web page generation allows cross-site scripting (XSS) via unsanitized URL schemes in Quill Delta output. The function to delta/2 converts Markdown into a Quill Delta, and the function default convert node/3 copies URLs from link, wikilink, or image nodes directly into the Delta link or image attributes without normalization or applying a scheme allowlist. An attacker providing Markdown text can include a javascript: URL that is passed verbatim into the Delta attribute. When a downstream renderer converts this Delta to HTML, the attribute becomes an <a href> or <img src>, executing the script in the browser of the user. Links and wikilinks are the primary vectors as they execute on click, while images have lower impact in modern browsers.

Recommendations Update leandrocp mdex to version 0.13.2 or later. As a temporary workaround, sanitize the Quill Delta produced by to delta/2 before rendering by dropping or blanking any link or image value with a URL scheme not included in a safe allowlist (e.g., http, https, mailto, tel).