Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53427— Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute

Quick assessment

Affected
leandrocp mdex
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Leandro Pereira MDExNative是加拿大Leandro Pereira个人开发者开源的一个服务器支撑系统。 leandrocp MDExNative 0.1.0版本至0.2.3之前版本存在跨站脚本漏洞，该漏洞源于输入中和不当，当启用语法高亮和完整信息字符串转发时，Lumis适配器将未转义的highlight_lines_class属性值复制到每个渲染行的class属性中，导致攻击者可通过控制Markdown进行存储型或反射型跨站脚本攻击，注入任意HTML和JavaScript，实现会话

AI Predicted 7.5 Difficulty: Easy EPSS 0.69% · P52

Affected Version Matrix 4

VendorProduct Version RangeStatus
leandrocp mdex 0.11.3< 0.12.3 affected
0d7ffc84ea742e1daf666426814e5bb6d0499433< 6ed94d905f97af188323f042698ae841c02293b4 affected
leandrocp mdex_native 0.1.0< 0.2.3 affected
956528c5e31746253347029e810a969ab916fd27< 798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53427

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown. When syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the value of a code fence's highlight_lines_class info-string attribute, unescaped, into the class attribute of every rendered line. comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes in native/comrak_nif/src/lumis_adapter.rs shlex-parses the info string and stores each key=value pair verbatim, highlight_lines_config pulls highlight_lines_class into the per-line class value, and write_highlighted interpolates that value directly into the class attribute of the per-line <div>. A single-quoted shell token preserves an inner double quote through shlex parsing, so a value such as '"><script>alert(1)</script>' terminates the class attribute early and the markup that follows is emitted as live HTML. An attacker who can submit Markdown (through comments, posts, wiki pages, documentation, or any user-generated content) can inject arbitrary HTML and JavaScript that runs in the browser of every user who views the rendered output, enabling session theft, account takeover, and other client-side attacks. No authentication or special privileges are required. The vulnerable native code originally shipped inside mdex (in native/comrak_nif/src/lumis_adapter.rs) and was later extracted into the separate mdex_native package (native/mdex_native_nif/src/lumis_adapter.rs), where it remains unpatched. This issue affects mdex from 0.11.3 before 0.12.3, and mdex_native from 0.1.0 before 0.2.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
leandrocp MDExNative 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Leandro Pereira MDExNative是加拿大Leandro Pereira个人开发者开源的一个服务器支撑系统。 leandrocp MDExNative 0.1.0版本至0.2.3之前版本存在跨站脚本漏洞，该漏洞源于输入中和不当，当启用语法高亮和完整信息字符串转发时，Lumis适配器将未转义的highlight_lines_class属性值复制到每个渲染行的class属性中，导致攻击者可通过控制Markdown进行存储型或反射型跨站脚本攻击，注入任意HTML和JavaScript，实现会话
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
leandrocp mdex 0.11.3 ~ 0.12.3 cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*
leandrocp mdex 0d7ffc84ea742e1daf666426814e5bb6d0499433 ~ 6ed94d905f97af188323f042698ae841c02293b4 cpe:2.3:a:leandrocp:mdex:*:*:*:*:*:*:*:*
leandrocp mdex_native 0.1.0 ~ 0.2.3 cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*
leandrocp mdex_native 956528c5e31746253347029e810a969ab916fd27 ~ 798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3 cpe:2.3:a:leandrocp:mdex_native:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-53427

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53427

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-53427 (3)

Same Patch Batch · leandrocp · 2026-06-29 · 6 CVEs total

CVE-2026-53429 Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial
CVE-2026-53426 Atom-table exhaustion denial-of-service via JSON parse_document in MDEx
CVE-2026-53428 Unbounded memory allocation in highlight_lines range expansion in mdex
CVE-2026-54888 Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex
CVE-2026-54889 Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)

IV. Related Vulnerabilities

Same product: mdex
Same vendor: leandrocp
Same weakness: CWE-79