CVE-2026-54889: mdex 0.8.3 to before 0.13.2

Affected technology

mdex · 0.8.3 to before 0.13.2
leandrocp

mdex · 9852db2456fdc9d856eb636603a7f608e22e3793 to before 2817147f5b87ce7186aa604c9ee72499485b8f2f
leandrocp

Component: 'Elixir.MDEx', 'Elixir.MDEx.DeltaConverter'
Function: 'Elixir.MDEx':to_delta/2, 'Elixir.MDEx.DeltaConverter':convert/2, 'Elixir.MDEx.DeltaConverter':default_convert_node/3
File: lib/mdex.ex, lib/mdex/delta_converter.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality and integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.