PT-2026-7809 · Unknown · Next-Mdx-Remote

Published 2026-02-12 · Updated 2026-02-14 · CVE-2026-0969

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions next-mdx-remote versions 4.3.0 through 5.0.0

Description The serialize function within next-mdx-remote does not adequately sanitize MDX content, leading to potential arbitrary code execution. This occurs when compiling MDX, particularly when server-side rendering untrusted MDX that includes JavaScript expressions. Exploitation could allow an attacker to execute code with server privileges. The issue affects systems utilizing Next.js or React server-side rendering.

Recommendations next-mdx-remote versions 4.3.0 through 5.0.0 should be upgraded to version 6.0.0 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-0969

GHSA-G4XW-JXRG-5F6M

Affected Products

Next-Mdx-Remote

References · 16

• https://osv.dev/vulnerability/GHSA-g4xw-jxrg-5f6m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0969 · Security Note
• https://github.com/hashicorp/next-mdx-remote/releases/tag/v6.0.0 · Note
• https://github.com/hashicorp/next-mdx-remote/commit/4d527fdcaed911b87f427d0b4d3c711e817fa4b3 · Note
• https://github.com/hashicorp/next-mdx-remote · Note
• https://twitter.com/RafterSecurity/status/2022462561367760947 · Twitter Post
• https://twitter.com/CCBalert/status/2021967609642549274 · Twitter Post
• https://twitter.com/SocketSecurity/status/2022055294231359504 · Twitter Post
• https://t.me/CVEtracker/44496 · Telegram Post
• https://twitter.com/ThreatSynop/status/2022206831062348181 · Twitter Post
• https://twitter.com/ThreatSynop/status/2022256176558231741 · Twitter Post
• https://twitter.com/CVEnew/status/2021799451946557822 · Twitter Post
• https://twitter.com/feross/status/2022025277736652820 · Twitter Post
• https://t.me/cveNotify/151799 · Telegram Post
• https://discuss.hashicorp.com/t/hcsec-2026-01-arbitrary-code-execution-in-react-server-side-rendering-of-untrusted-mdx-content/77155 · Note