The vulnerability is the uncontrolled inclusion of arbitrary URL schemes in the Quill Delta output by the mdex library. When the Delta is rendered by downstream tools such as quill‑delta‑to‑html or the Quill client, a URL containing a javascript: scheme is turned into an <a> or <img> element that executes code in the viewer’s browser. An attacker who can supply Markdown text can therefore inject javascript: links or images, leading to the execution of arbitrary scripts, cookie theft, and other client‑side compromise. The impact is a classic XSS that affects the confidentiality and integrity of the rendered content and individuals who view it.

The affected product is leandrocp mdex. Versions impacted are 0.8.3 through 0.13.1. Vendors should verify the exact build they are running and plan updates accordingly.

The calculated CVSS score of 5.1 indicates a medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is in untrusted input handling and the exploit requires only that the attacker supply Markdown text, the likelihood of successful exploitation is high in contexts where mdex output is rendered in a web page. The attack is delivered via a yet‑unfiltered JavaScript URL within the Delta, making it trivial to craft.