CVE-2026-0969
CVE-2026-0969 · Arbitrary code execution in React server-side rendering of untrusted MDX content
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0.
CVSS 8.8 · High · EPSS 0.6% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
shared library
- Versions
- ≥ 4.3.0, < 6.0.0: Affected (semver)
Update to 6.0.0
next-mdx-remote npm
- Affected ranges
- SEMVER: ≥ 4.3.0, < 6.0.0
Update to 6.0.0