CVE-2026-54889
1 advisory.
Hex/mdex CVE-2026-54889: medium 5.1, EPSS 0.39%
Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)
Action: Upgrade mdex to 0.13.2 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.8.3 | 0.13.2 | - |
Fixed versions
| 0.13.2 |
Sources
- osv: EEF-CVE-2026-54889
- nvd: CVE-2026-54889
- https://github.com/leandrocp/mdex/security/advisories/GHSA-4383-7xfp-gpph
- https://cna.erlef.org/cves/CVE-2026-54889.html
- https://github.com/leandrocp/mdex/commit/2817147f5b87ce7186aa604c9ee72499485b8f2f
- https://hex.pm/packages/mdex
CVE-2026-54889 · published · modified · JSON