« Volver al listado

CVE-2025-24981

Estado: AplazadaCrítica (9.3)—

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the `javascript:` protocol scheme in the URL. The parsing logic implement in `props.ts` maintains a deny-list approach to filtering potential malicious payload. It does so by matching protocol schemes like `javascript:` and others.

Leer descripción completaMostrar menos

These security guards can be bypassed by an adversarial that provides JavaScript URLs with HTML entities encoded via hex string. Users who consume this library and perform markdown parsing from unvalidated sources could result in rendering vulnerable XSS anchor links. This vulnerability has been addressed in version 0.13.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningRestrict Web-Based ContentPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network Traffic

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

MDC — MDCAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-24981",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24981",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-06T19:33:19.101192Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.3,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "nuxt-modules",
          "product": "mdc",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.13.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-02-06T18:15:32.847",
  "references": [
    {
      "url": "https://github.com/nuxt-modules/mdc/blob/main/src/runtime/parser/utils/props.ts#L16",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nuxt-modules/mdc/commit/99097738b5561639e9bf247c55d8103236618bf3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nuxt-modules/mdc/security/advisories/GHSA-j82m-pc2v-2484",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the `javascript:` protocol scheme in the URL. The parsing logic implement in `props.ts` maintains a deny-list approach to filtering potential malicious payload. It does so by matching protocol schemes like `javascript:` and others. These security guards can be bypassed by an adversarial that provides JavaScript URLs with HTML entities encoded via hex string. Users who consume this library and perform markdown parsing from unvalidated sources could result in rendering vulnerable XSS anchor links. This vulnerability has been addressed in version 0.13.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability."
    },
    {
      "lang": "es",
      "value": "MDC es una herramienta para tomar Markdown regular y escribir documentos que interactúan profundamente con un componente Vue. En las versiones afectadas, la lógica de análisis insegura de la URL de Markdown puede generar código JavaScript arbitrario debido a una omisión de las protecciones existentes en torno al esquema de protocolo `javascript:` en la URL. La lógica de análisis implementada en `props.ts` mantiene un enfoque de lista de denegación para filtrar el payload malicioso potencial. Lo hace al hacer coincidir esquemas de protocolo como `javascript:` y otros. Estas protecciones de seguridad pueden ser omitidas por un adversario que proporcione URL de JavaScript con entidades HTML codificadas a través de una cadena hexadecimal. Los usuarios que consumen esta librería y realizan análisis de Markdown desde fuentes no validadas podrían generar enlaces de anclaje XSS vulnerables. Esta vulnerabilidad se ha solucionado en la versión 0.13.3 y se recomienda a todos los usuarios que actualicen. No existen workarounds para esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T08:59:55.240",
  "sourceIdentifier": "security-advisories@github.com"
}