CVE-2025-24981

CVE-2025-24981 is a cross-site scripting (XSS) vulnerability affecting the MDC library, a tool for converting Markdown into documents that interact deeply with Vue components. The issue stems from unsafe URL parsing logic in the `props.ts` file, which uses a deny-list to filter malicious protocol schemes like `javascript:`. This guard can be bypassed by encoding JavaScript URLs with HTML entities via hex strings, allowing arbitrary JavaScript execution when parsing unvalidated Markdown sources.

Attackers can exploit this vulnerability remotely over the network with low complexity, requiring no privileges or user interaction, as indicated by its CVSS v3.1 score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L). Any user or application consuming affected versions of MDC and rendering Markdown from untrusted sources risks executing attacker-supplied JavaScript through vulnerable XSS anchor links, potentially leading to high confidentiality impacts in a changed scope.

The GitHub security advisory (GHSA-j82m-pc2v-2484) confirms the vulnerability has been fixed in MDC version 0.13.3, with users advised to upgrade immediately. The patching commit (99097738b5561639e9bf247c55d8103236618bf3) addresses the bypass in `props.ts`, and no workarounds are available.