next-mdx-remote Vulnerability
A security vulnerability has been discovered in next-mdx-remote, a popular TypeScript library used for rendering MDX content in React applications.
The flaw, tracked as CVE-2026-0969 and identified by researchers at Sejong University, enables attackers to execute arbitrary code on servers when untrusted MDX content is processed.
The vulnerability affects the serialize function in next-mdx-remote versions 4.3.0 through 5.0.0, which is used to compile MDX content for dynamic rendering on client or server environments.
HashiCorp disclosed the vulnerability on February 11, 2026, under bulletin HCSEC-2026-01.
The root cause lies in insufficient sanitization of MDX content when JavaScript expressions are enabled.
Attackers can exploit this weakness by injecting malicious code through user-supplied MDX content, potentially gaining remote code execution capabilities on affected servers.
This poses a significant threat to applications that allow untrusted users to submit MDX content for server-side rendering.
HashiCorp has addressed the vulnerability in next-mdx-remote version 6.0.0 with significant security enhancements.
The update introduces a breaking change that disables JavaScript expressions by default through the blockJS option set to true for both serialize and compileMDX functions.
This prevents arbitrary code execution in most deployment scenarios.
For applications that require JavaScript expressions, version 6.0.0 provides an additional safety layer through the blockDangerousJS option, enabled by default when blockJS is set to false.
This feature offers best-effort protection against dangerous operations including eval, Function, process, require, and other global objects that could facilitate code execution attacks.
| CVE ID | Description | Affected Versions |
|---|---|---|
| CVE-2026-0969 | Arbitrary code execution due to insufficient sanitization in serialize function when processing untrusted MDX content with JavaScript expressions enabled | 4.3.0 – 5.0.0 |
Organizations using next-mdx-remote in server environments where untrusted user input is processed should immediately assess their exposure to this vulnerability.
Upgrading to version 6.0.0 is strongly recommended to eliminate the risk of arbitrary code execution.
Administrators should review their implementations to ensure proper configuration of the new security options and verify that JavaScript expressions are only enabled when necessary and with appropriate safeguards in place.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…