CVE-2026-0969 — Arbitrary code execution in React server-side rendering of untrusted MDX content

CVE-2026-0969

Arbitrary code execution in React server-side rendering of untrusted MDX content PUBLISHED

Description (CNA)

The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Shared library	affected 4.3.0 before 6.0.0

CWE

CWE-94

References

https://discuss.hashicorp.com/t/hcsec-2026-01-arbitrary-code-execution-in-react-server-side-rendering-of-untrusted-mdx-content/77155

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.