8.8High
CVE-2026-0969Arbitrary code execution in React server-side rendering of untrusted MDX content
Description
The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0.
Weakness (CWE):
CWE-94
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| HashiCorp | Shared library | 4.3.0 – < 6.0.0 |