{"action":"Upgrade mdex to 0.13.2 or later.","affected":[{"fixed":"0.13.2","introduced":"0.8.3"}],"component":"mdex","cve_ids":["CVE-2026-54889"],"ecosystem":"Hex","epss":0.00393,"exploited":false,"fixed_versions":["0.13.2"],"ghsa_id":"GHSA-4383-7xfp-gpph","id":"tcs_01M5N85B2ZJN8EXNN1HPBCNRZ4","modified_at":"2026-09-08T03:30:05.324359649Z","published_at":"2026-06-29T19:10:49.841Z","references":["https://osv.dev/vulnerability/EEF-CVE-2026-54889","https://github.com/leandrocp/mdex/security/advisories/GHSA-4383-7xfp-gpph","https://cna.erlef.org/cves/CVE-2026-54889.html","https://github.com/leandrocp/mdex/commit/2817147f5b87ce7186aa604c9ee72499485b8f2f","https://hex.pm/packages/mdex"],"severity":{"label":"medium","score":5.1},"sources":[{"source":"osv","source_id":"EEF-CVE-2026-54889","url":"https://osv.dev/vulnerability/EEF-CVE-2026-54889"},{"source":"nvd","source_id":"CVE-2026-54889","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54889"}],"summary":"Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)"}