Skip to content

[GHSA-g4xw-jxrg-5f6m] The serialize function used to compile MDX in next-mdx... #6992

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dduzgun-security wants to merge 1 commit into
base: dduzgun-security/advisory-improvement-6992
Choose a base branch
from
+27 −2
Open

[GHSA-g4xw-jxrg-5f6m] The serialize function used to compile MDX in next-mdx... #6992

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 27 additions & 2 deletions advisories/unreviewed/2026/02/GHSA-g4xw-jxrg-5f6m/GHSA-g4xw-jxrg-5f6m.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,35 @@
"aliases": [
"CVE-2026-0969"
],
"details": "The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content.",
"summary": "Arbitrary code execution in React server-side rendering of untrusted MDX content ",
Copy link

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The summary field has a trailing space at the end which should be removed. The text "Arbitrary code execution in React server-side rendering of untrusted MDX content " ends with an extra space character.

Suggested change
"summary": "Arbitrary code execution in React server-side rendering of untrusted MDX content ",
"summary": "Arbitrary code execution in React server-side rendering of untrusted MDX content",

Copilot uses AI. Check for mistakes.
"details": "The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "next-mdx-remote"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.3.0"
},
{
"fixed": "6.0.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
Expand All @@ -22,6 +43,10 @@
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2026-01-arbitrary-code-execution-in-react-server-side-rendering-of-untrusted-mdx-content/77155"
},
{
"type": "PACKAGE",
"url": "https://github.com/hashicorp/next-mdx-remote"
}
],
"database_specific": {
Expand Down
Loading