HIGHCVSS v3.1 8.2Vulnerability
CVE-2026-126774
@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx file, executing JavaScript in visitors' browsers or on build and server-side rendering hosts.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Cvss severity
- HIGH
- Cvss score
- 8.2
- Retrieved at
- 2026-11-11T23:50:18+00:00
- Score
- 8.2
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-126774
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
- First seen by Signal
- 2026-11-11T19:44:24+00:00
- Name
- CVE-2026-126774
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
- Published at
- 2026-11-11T19:17:37.937
- Last modified
- 2026-11-11T19:17:37.937
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph