Description
The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HashiCorp | Shared library | 4.3.0 – < 6.0.0 | 6.0.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | next-mdx-remote | >= 4.3.0, < 6.0.0 | 6.0.0 | GHSA-g4xw-jxrg-5f6m |