CVE-2026-0969 — Arbitrary code execution in React server-side rendering of untrusted MDX content
The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-…
Published: 2026-02-12 · CVSS: 8.8 · CVSS 3.1
The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7