CVE-2026-53427 is a CWE-79 cross-site scripting vulnerability in leandrocp MDEx and mdex_native. When syntax highlighting and full info-string forwarding (render: [full_info_string: true]) are enabled, the Lumis adapter copies the highlight_lines_class info-string attribute from a Markdown code fence into the class attribute of each rendered line without escaping. The parsing preserves inner double quotes, enabling an attacker to inject payloads such as '"><script>alert(1)</script>' that break out of the class attribute and execute arbitrary JavaScript in users' browsers. This vulnerability affects mdex versions >=0.11.3 and <0.12.3, and mdex_native versions >=0.1.0 and <0.2.3. No authentication or special privileges are required for exploitation. The vulnerable code was originally part of mdex and later extracted into mdex_native, where it remains unpatched. No official fix or vendor advisory is currently available.

An attacker who can submit Markdown content (e.g., via comments, posts, wiki pages, or documentation) can inject arbitrary HTML and JavaScript that executes in the browsers of users viewing the rendered content. This can lead to session theft, account takeover, and other client-side attacks. The vulnerability requires no authentication or special privileges. The CVSS 4.0 score is 2.3 (low severity), reflecting network attack vector, low complexity, partial attack traceability, and user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid enabling syntax highlighting with full info-string forwarding (render: [full_info_string: true]) in affected versions. Restrict or sanitize user-submitted Markdown content to prevent injection of malicious info-string attributes. Monitor vendor channels for updates and apply official patches once available.