The serialize function used to compile MDX in the next-mdx-remote library lacks proper sanitization, allowing an attacker to inject and execute arbitrary code when MDX content is rendered on the server. This flaw corresponds to CWE-94 and can compromise the confidentiality, integrity, and availability of the affected system.

HashiCorp’s shared library, which incorporates next-mdx-remote, is impacted. All installations that rely on this library and have not applied the fix available in version 6.0.0 are potentially vulnerable; specific version information is not supplied in the advisory.

The CVSS score of 8.8 indicates high severity, but the EPSS score is below 1%, suggesting a low probability of exploitation in the current landscape. The vulnerability is not listed in the KEV catalog. The likely attack vector involves an entity that can supply malicious MDX content to the server-side rendering process; if such input is accepted, the attacker can run arbitrary code with the process’s privileges.