CVE-2025-24981
Published: 06 February 2025
Summary
CVE-2025-24981 is a critical-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-24981 is a cross-site scripting (XSS) vulnerability affecting the MDC library, a tool for converting Markdown into documents that interact deeply with Vue components. The issue stems from unsafe URL parsing logic in the `props.ts` file, which uses a deny-list to filter malicious protocol schemes like `javascript:`. This guard can be bypassed by encoding JavaScript URLs with HTML entities via hex strings, allowing arbitrary JavaScript execution when parsing unvalidated Markdown sources.
Attackers can exploit this vulnerability remotely over the network with low complexity, requiring no privileges or user interaction, as indicated by its CVSS v3.1 score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L). Any user or application consuming affected versions of MDC and rendering Markdown from untrusted sources risks executing attacker-supplied JavaScript through vulnerable XSS anchor links, potentially leading to high confidentiality impacts in a changed scope.
The GitHub security advisory (GHSA-j82m-pc2v-2484) confirms the vulnerability has been fixed in MDC version 0.13.3, with users advised to upgrade immediately. The patching commit (99097738b5561639e9bf247c55d8103236618bf3) addresses the bypass in `props.ts`, and no workarounds are available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4001
Vulnerability details
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the…
more
existing guards around the `javascript:` protocol scheme in the URL. The parsing logic implement in `props.ts` maintains a deny-list approach to filtering potential malicious payload. It does so by matching protocol schemes like `javascript:` and others. These security guards can be bypassed by an adversarial that provides JavaScript URLs with HTML entities encoded via hex string. Users who consume this library and perform markdown parsing from unvalidated sources could result in rendering vulnerable XSS anchor links. This vulnerability has been addressed in version 0.13.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XSS vuln in public-facing Markdown/Vue library enables remote exploitation of web apps (T1190) and direct arbitrary JavaScript execution (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, and correction of system flaws like the URL parsing bypass in MDC, directly mitigated by upgrading to version 0.13.3 as specified in the advisory.
SI-10 mandates validation of information inputs such as untrusted Markdown sources containing encoded javascript: URLs, preventing the bypass of the library's deny-list parsing logic.
SI-15 enforces filtering of information outputs like rendered anchor links from Markdown, blocking execution of arbitrary JavaScript from vulnerable XSS payloads.