The vulnerability in leandrocp mdex arises from improper neutralization of input during web page generation (CWE-79). Specifically, the function 'Elixir.MDEx.DeltaConverter':default_convert_node/3 copies link, wikilink, or image URLs from Markdown into Quill Delta attributes without applying a scheme allowlist or normalization. An attacker controlling Markdown can embed a javascript: URL that persists into the Delta output. When this Delta is rendered to HTML by downstream renderers or clients, the javascript: scheme executes in the browser, leading to cross-site scripting. The strongest attack vectors are links and wikilinks, as javascript: in href attributes executes on click, while javascript: in image src attributes is less impactful due to modern browser protections. This affects mdex versions starting at 0.8.3 up to but not including 0.13.2.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of users viewing the rendered content, potentially leading to session theft, user impersonation, or other client-side attacks. The impact is rated medium with a CVSS score of 5.1, reflecting network attack vector, low complexity, no privileges required, user interaction needed, and limited confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, avoid rendering untrusted Markdown content with mdex or ensure that URLs in Markdown are sanitized and validated to disallow javascript: schemes before conversion to Quill Delta.