{"metadata": {"vulnerability": "CVE-2026-63671", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-07-17T14:47:08.032Z", "date_only": false, "value": "2026-07-17T14:47:08.032Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-63671", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-16T14:25:47.539Z", "date_only": false, "value": "2026-09-16T14:25:47.539Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-63671", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-16T14:25:47.539Z", "date_only": false, "value": "2026-09-16T14:25:47.539Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-63671", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-16T15:17:40Z", "date_only": false, "value": "2026-09-16T15:17:40Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MXM6-V9R6-R94C", "record": "GHSA-MXM6-V9R6-R94C", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-16T15:17:40.100Z", "date_only": false, "value": "2026-09-16T15:17:40.100", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63671", "record": "FKIE_CVE-2026-63671", "field": "published"}, {"timestamp": "2026-09-16T22:14:01Z", "date_only": false, "value": "2026-09-16T22:14:01Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MXM6-V9R6-R94C", "record": "GHSA-MXM6-V9R6-R94C", "field": "published"}, {"timestamp": "2026-09-16T22:14:01Z", "date_only": false, "value": "2026-09-16T22:14:01Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MXM6-V9R6-R94C", "record": "GHSA-MXM6-V9R6-R94C", "field": "modified"}, {"timestamp": "2026-09-17T00:35:04.905Z", "date_only": false, "value": "2026-09-17T00:35:04.905832Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/nuxt-content/mdc/security/advisories/GHSA-mxm6-v9r6-r94c", "record": "CVE-2026-63671", "field": "creation_timestamp", "uuid": "a8b6b17e-7f60-4ea9-9007-397245d8cfb4", "url": "https://github.com/nuxt-content/mdc/security/advisories/GHSA-mxm6-v9r6-r94c"}, {"timestamp": "2026-09-17T01:31:24.272Z", "date_only": false, "value": "2026-09-17T01:31:24.272237Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/5ecaf58f0525c80ea68a1ae98625c2a7", "record": "CVE-2026-63671", "field": "creation_timestamp", "uuid": "99abd818-4e47-4a12-a410-18a5c43038a1", "content": "# CVE-2026-63671: CVE-2026-63671: Cross-Site Scripting (XSS) Sanitizer Bypass in @nuxtjs/mdc\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63671\n\n## Summary\nA cross-site scripting (XSS) vulnerability was identified in @nuxtjs/mdc prior to version 0.22.1. Gaps in the HTML/SVG attribute verification and URL protocol parsing allow unauthenticated remote attackers to bypass the application's sanitization routines. By embedding malicious SVG links or data-encoded iframe elements within Markdown, attackers can execute arbitrary JavaScript in the victim's browser context.\n\n## TL;DR\nUnauthenticated XSS vulnerability in @nuxtjs/mdc prior to 0.22.1 allows attackers to bypass URL sanitizers and execute arbitrary scripts via crafted SVG xlink:href attributes and data:text/html URIs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79, CWE-184\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.1\n- **Exploit Status**: poc\n- **KEV Status**: Not listed\n- **Impact**: Cross-Site Scripting (XSS)\n\n## Affected Systems\n\n- @nuxtjs/mdc prior to version 0.22.1\n- Nuxt Content projects relying on vulnerable parser dependencies\n- **@nuxtjs/mdc**: < 0.22.1 (Fixed in: `0.22.1`)\n\n## Mitigation\n\n- Upgrade @nuxtjs/mdc to version 0.22.1 or newer\n- Disable raw and dangerous HTML rendering inside markdown parser settings by configuring allowDangerousHtml to false\n- Implement a strong Content Security Policy (CSP) restricting inline script execution and unauthorized data: schemes\n\n**Remediation Steps:**\n1. Identify all project dependencies relying on @nuxtjs/mdc or nuxt-content\n2. Update the dependency using your package manager: npm install @nuxtjs/mdc@latest or pnpm update @nuxtjs/mdc\n3. Audit your markdown processing configurations to ensure unvalidated user inputs do not leverage allowDangerousHtml\n4. Deploy CSP headers restricting script-src elements to verified origins\n\n## References\n\n- [GitHub Security Advisory GHSA-mxm6-v9r6-r94c](https://github.com/nuxt-content/mdc/security/advisories/GHSA-mxm6-v9r6-r94c)\n- [Official Fix Commit](https://github.com/nuxt-content/mdc/commit/61d636c2983f021288e4fc5c4006733b38cf0d53)\n- [Pull Request #491](https://github.com/nuxt-content/mdc/pull/491)\n- [Release Tag v0.22.1](https://github.com/nuxt-content/mdc/releases/tag/v0.22.1)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-63671)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63671) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/5ecaf58f0525c80ea68a1ae98625c2a7"}, {"timestamp": "2026-09-18T17:53:48.238Z", "date_only": false, "value": "2026-09-18T17:53:48.238587Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63671", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-18T17:53:48.238Z", "date_only": false, "value": "2026-09-18T17:53:48.238587Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63671", "record": "FKIE_CVE-2026-63671", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-18T17:54:37.852Z", "date_only": false, "value": "2026-09-18T17:54:37.852Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-63671", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-18T17:54:37.852Z", "date_only": false, "value": "2026-09-18T17:54:37.852Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63671", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-24T21:25:27.050Z", "date_only": false, "value": "2026-09-24T21:25:27.050", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63671", "record": "FKIE_CVE-2026-63671", "field": "lastModified"}]}