CVE-2026-0969 – next-mdx Remote Code Execution Vulnerability
“A weakness in a content processing library could allow attackers to inject code and compromise applications that render MDX content.”
This patch addresses a high-severity vulnerability (CVE-2026-0969) affecting next-mdx, a library used with Next.js applications to render MDX content that combines Markdown with JSX components. The issue stems from improper handling and validation of user-supplied MDX content during the compilation and rendering process.
An attacker could exploit this weakness by supplying malicious MDX content that triggers remote code execution within the application environment. Successful exploitation may allow attackers to manipulate application behavior, access sensitive data, or compromise the server hosting the application. CVE-2026-0969 carries a CVSS v3.1 score of 8.8 (High).
Security updates correct the unsafe processing logic and strengthen validation of MDX content before it is compiled and executed. Applications using vulnerable versions of next-mdx remain exposed until the patched version of the library is deployed.