CVE-2026-53427: mdex 0.11.3 to before 0.12.3; +1 more affected products

Affected technology

mdex · 0.11.3 to before 0.12.3
leandrocp

mdex · 0d7ffc84ea742e1daf666426814e5bb6d0499433 to before 6ed94d905f97af188323f042698ae841c02293b4
leandrocp

mdex_native · 0.1.0 to before 0.2.3
leandrocp

mdex_native · 956528c5e31746253347029e810a969ab916fd27 to before 798a363b4339f6f7162ec8437c4c9f9b5ae6fbf3
leandrocp

Component: 'Elixir.MDEx', comrak_nif, 'Elixir.MDExNative.Comrak', mdex_native_nif
Function: comrak_nif::lumis_adapter::LumisAdapter::parse_custom_attributes, comrak_nif::lumis_adapter::LumisAdapter::highlight_lines_config, comrak_nif::lumis_adapter::LumisAdapter::write_highlighted, 'Elixir.MDEx':to_html/2, mdex_native_nif::lumis_adapter::LumisAdapter::parse_custom_attributes, mdex_native_nif::lumis_adapter::LumisAdapter::highlight_lines_config, mdex_native_nif::lumis_adapter::LumisAdapter::write_highlighted, 'Elixir.MDExNative.Native':document_to_html_with_options/2, 'Elixir.MDExNative.Comrak':document_to_html/2
File: native/comrak_nif/src/lumis_adapter.rs, native/mdex_native_nif/src/lumis_adapter.rs

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 2.3/10) rates confidentiality, integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.