CVE-2026-54889 Details
Description
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex allows cross-site scripting via unsanitized URL schemes in Quill Delta output. 'Elixir.MDEx':to_delta/2 converts Markdown into a Quill Delta. 'Elixir.MDEx.DeltaConverter':default_convert_node/3 in lib/mdex/delta_converter.ex copies the URL of a link, wikilink, or image node directly from the parsed Markdown into the Delta "link" or "image" attribute without applying a scheme allowlist or any normalization. An attacker who controls the Markdown text can supply a javascript: URL (for example [click](javascript:alert(document.cookie))) that survives verbatim into the Delta attribute. When the Delta is rendered to HTML by a downstream renderer (such as quill-delta-to-html or the Quill client), the attribute becomes an <a href> or <img src>, and the javascript: scheme executes in the browser of anyone who views the rendered content. The link and wikilink cases are the strongest vectors because javascript: in an href executes on click; the image case is lower impact because javascript: in <img src> generally does not execute in modern browsers. This issue affects mdex: from 0.8.3 before 0.13.2.
A cross-site scripting (XSS) vulnerability has been identified in the MDEx library by leandrocp, specifically in versions 0.8.3 prior to 0.13.2. The issue arises in the 'to_delta/2' function, which converts Markdown into Quill Delta format. The vulnerability occurs because the 'default_convert_node/3' method in the DeltaConverter module directly transfers URLs from the parsed Markdown into Delta attributes without proper sanitization or scheme validation. This oversight allows an attacker to inject 'javascript:' URLs that execute in the browser when the Delta is rendered to HTML. The vulnerability is particularly impactful with links and wikilinks, as 'javascript:' in an 'href' attribute executes on click, while the image case is less severe since 'javascript:' in an '<img src>' generally does not run in modern browsers.
Users can update to MDEx version 0.13.2 or later, where this vulnerability has been fixed. For those using earlier versions, a workaround is to sanitize the Quill Delta produced by 'MDEx.to_delta/2' before rendering it. This can be done by removing or blanking any 'link' or 'image' values with URL schemes not included in a safe allowlist (http, https, mailto, tel).
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 29, 2026CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/leandrocp/mdex/security/advisories/GHSA-4383-7xfp-gpph | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://cna.erlef.org/cves/CVE-2026-54889.html | EEF | AdvisoryRemedy |
| https://github.com/leandrocp/mdex/commit/2817147f5b87ce7186aa604c9ee72499485b8f2f | EEF | Source CodeVendor |
| https://github.com/leandrocp/mdex/security/advisories/GHSA-4383-7xfp-gpph | EEF | AdvisoryExploitRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-54889 | EEF | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | EEF |
Affected Products
| Product | Versions |
|---|---|
| leandrocp mdex | >= 0.8.3, < 0.13.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | New CVE Received | EEF |