{"id":"CVE-2026-53427","aliases":["EEF-CVE-2026-53427","EUVD-2026-40174","GHSA-v664-pmxr-mxxx"],"status":"published","title":"Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.\n\nWhen syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence's highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line \u003cdiv\u003e. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as '\"\u003e\u003cscript\u003ealert(1)\u003c/script\u003e' terminates the class attribute early and the markup that follows is emitted as live HTML.\n\nAn attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.\n\nThe vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched.\n\nThis issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00688,"percentile":0.53207,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-06-29T18:50:17Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"Hex","package":"mdex","fixed_in":["0.12.3"],"sources":["osv"]},{"ecosystem":"Hex","package":"mdex_native","fixed_in":["0.2.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Hex","package":"mdex","ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.3"},{"fixed":"0.12.3"}]}],"versions":["0.11.3","0.11.4","0.11.5","0.11.6","0.11.7","0.12.0","0.12.1","0.12.2"]},{"source":"osv","ecosystem":"Hex","package":"mdex_native","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"0.2.3"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.2.0","0.2.1","0.2.2"]}],"products":[{"vendor":"leandrocp","product":"mdex"},{"vendor":"leandrocp","product":"mdex_native"}],"references":[{"url":"https://github.com/leandrocp/mdex_native/security/advisories/GHSA-v664-pmxr-mxxx","tags":["vendor-advisory","related","advisory"]},{"url":"https://cna.erlef.org/cves/CVE-2026-53427.html","tags":["related","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-53427","tags":["related","web"]},{"url":"https://github.com/leandrocp/mdex_native/commit/798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3","tags":["patch","fix"]},{"url":"https://github.com","tags":["web"]},{"url":"https://repo.hex.pm","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53427.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53427","tags":["advisory"]},{"url":"https://github.com/leandrocp/mdex","tags":["package"]},{"url":"https://github.com/leandrocp/mdex_native","tags":["package"]},{"url":"https://hex.pm/packages/mdex","tags":["package"]},{"url":"https://hex.pm/packages/mdex_native","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-53427","title":"Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.\n\nWhen syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence's highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line \u003cdiv\u003e. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as '\"\u003e\u003cscript\u003ealert(1)\u003c/script\u003e' terminates the class attribute early and the markup that follows is emitted as live HTML.\n\nAn attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.\n\nThe vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched.\n\nThis issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.","status":"published","published":"2026-06-29T18:50:17.185Z","modified":"2026-06-30T04:37:51.902Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:59.761005Z"}],"euvd":[{"id":"EUVD-2026-40174","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.\n\nWhen syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence's highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line \u003cdiv\u003e. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as '\"\u003e\u003cscript\u003ealert(1)\u003c/script\u003e' terminates the class attribute early and the markup that follows is emitted as live HTML.\n\nAn attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.\n\nThe vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched.\n\nThis issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.","status":"published","published":"2026-06-29T18:50:17Z","modified":"2026-06-30T04:37:51Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"low"}],"updated_at":"2026-11-02T18:20:22.124605Z"}],"nvd":[{"id":"CVE-2026-53427","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.\n\nWhen syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence's highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line \u003cdiv\u003e. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as '\"\u003e\u003cscript\u003ealert(1)\u003c/script\u003e' terminates the class attribute early and the markup that follows is emitted as live HTML.\n\nAn attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.\n\nThe vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched.\n\nThis issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.","status":"published","published":"2026-06-29T19:16:41.597Z","modified":"2026-10-25T21:10:00.77Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:26.508751Z"}],"osv":[{"id":"CVE-2026-53427","title":"Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.\n\nWhen syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence's highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line \u003cdiv\u003e. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as '\"\u003e\u003cscript\u003ealert(1)\u003c/script\u003e' terminates the class attribute early and the markup that follows is emitted as live HTML.\n\nAn attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.\n\nThe vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched.\n\nThis issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.","status":"published","published":"2026-06-29T18:50:17.185Z","modified":"2026-10-28T02:31:00.370538065Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:07.787185Z"},{"id":"EEF-CVE-2026-53427","title":"Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute","description":"## Summary\n\nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.\n\nWhen syntax highlighting and full info-string forwarding (render: \\[full\\_info\\_string: true\\]) are enabled, the Lumis adapter copies the value of a code fence's highlight\\_lines\\_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak\\_nif::lumis\\_adapter::LumisAdapter::parse\\_custom\\_attributes in native/comrak\\_nif/src/lumis\\_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight\\_lines\\_config pulls highlight\\_lines\\_class into the per-line class value, and write\\_highlighted interpolates that value directly into the class attribute of the per-line \u003cdiv\u003e. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as '\"\u003e\u003cscript\u003ealert(1)\u003c/script\u003e' terminates the class attribute early and the markup that follows is emitted as live HTML.\n\nAn attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required.\n\nThe vulnerable native code originally shipped inside mdex (in native/comrak\\_nif/src/lumis\\_adapter.rs) and was later extracted into the separate mdex\\_native package (native/mdex\\_native\\_nif/src/lumis\\_adapter.rs), where it remains unpatched.\n\nThis issue affects mdex from 0.11.3 before 0.12.3, and mdex\\_native from 0.1.0 before 0.2.3.\n\n## Workarounds\n\nDo not enable full info-string forwarding (render: \\[full\\_info\\_string: true\\]) when rendering untrusted Markdown, which prevents the highlight\\_lines\\_class attribute from reaching the highlighter. Alternatively, restrict highlight\\_lines\\_class values to a safe character set (for example \\[A-Za-z0-9\\_- \\]) before rendering.\n\n## Configurations\n\nThe vulnerable code path is only reachable when MDEx is configured with a syntax-highlighting formatter (for example syntax\\_highlight: \\[formatter: {:html\\_inline, ...}\\] or {:html\\_linked, ...}) and with full info-string forwarding enabled (render: \\[full\\_info\\_string: true\\]). Full info-string forwarding is required for comrak to hand the highlight\\_lines\\_class attribute to the highlighter, so any application that uses the line-highlighting attributes already has it enabled.","status":"published","published":"2026-06-29T18:50:17.185Z","modified":"2026-09-08T03:30:05.104633525Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:33.520522Z"}]}}