Loading story…
HashiCorp disclosed HCSEC-2026-01 (tracked as CVE-2026-0969 / GHSA-g4xw-jxrg-5f6m) affecting the next-mdx-remote library used by Next.js applications to render MDX content. The flaw can lead to arbitrary code execution when applications server-side render untrusted MDX due to insufficient sanitization in the serialize compilation path, particularly when JavaScript expressions in MDX are permitted; the issue is categorized as CWE-94 (code injection) and reported with a CVSS 3.1 score of 8.8 (High).
Guidance from the Canadian Centre for Cyber Security and third-party analysis both recommend updating affected deployments. Impacted versions are reported as 4.3.0 through 5.0.0 (Cyber Centre advisory) and 4.3.0 up to but not including 6.0.0 (Socket), with remediation available in 6.0.0; the 6.0.0 release also changes defaults to reduce exposure by disabling JavaScript expressions by default (blockJS: true) and adding additional guardrails when dangerous JS is explicitly enabled (e.g., best-effort blocking of constructs like eval, Function, process, and require).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-12, the Canadian Centre for Cyber Security published alert AV26-123 referencing HashiCorp's advisory and urging users and administrators to review the guidance and apply necessary updates. The notice highlighted the arbitrary code execution risk in affected next-mdx-remote versions.
HashiCorp reported the vulnerability is fixed in next-mdx-remote 6.0.0. The release changes defaults to disable JavaScript expressions by default and adds additional protections when expressions are explicitly enabled.
On 2026-02-11, HashiCorp published advisory HCSEC-2026-01 describing a high-severity arbitrary code execution vulnerability in next-mdx-remote when untrusted MDX is server-side rendered. The issue affects versions starting at 4.3.0 and was assigned CVE-2026-0969 / GHSA-g4xw-jxrg-5f6m.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecyber.gc.ca
Open sourcediscuss.hashicorp.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **`CVE-2026-33120`** was disclosed in Microsoft SQL Server, where an untrusted pointer dereference can allow **remote code execution** by an authenticated attacker with low privileges. The flaw is rated **CVSS 8.8** and can be exploited over the network without user interaction, with potential impact across confidentiality, integrity, and availability. Successful exploitation could lead to **system-level compromise** of the database server, enabling database theft, credential dumping, lateral movement, and possible tenant-isolation escape in shared or multi-tenant deployments. A separate disclosure, **`CVE-2026-40155`**, affects the **Auth0 Next.js SDK** and stems from a race condition in the DPoP proxy fetcher that can expose one user’s session identifiers, access tokens, or API response data to another concurrent authenticated user. The issue is rated **CVSS 5.4** and is considered harder to exploit because it depends on precise timing, DPoP challenges, and concurrent requests reaching the application tier. Its impact is focused on **data confidentiality**, with low integrity impact, no availability impact, a low EPSS score, and no listing in CISA’s Known Exploited Vulnerabilities catalog.
Jun 29, 2026
A critical remote code execution flaw tracked as **CVE-2025-71389** affects the self-hosted **Cal.com `cal.diy`** product in versions before **5.9.9**, allowing attackers to execute arbitrary code on the server without authentication or user interaction. The bug stems from Cal.com bundling a vulnerable **Next.js** release affected by the React Server Components deserialization issue **CVE-2025-55182**, enabling exploitation through a single crafted HTTP request to an RSC endpoint. The vulnerability has been described as severe, with reporting citing a **CVSS 10.0** rating and weakness mapping to **`CWE-94`**. The issue was fixed in **cal.diy 5.9.9** by updating the affected Next.js dependency. Reporting on the upstream Next.js flaw says it was added to CISA's **Known Exploited Vulnerabilities** catalog and has seen public proof-of-concept release and real-world abuse by multiple threat actors, including activity linked to cryptominer deployment. Organizations running self-hosted Cal.com instances are being urged to upgrade immediately, limit exposure of RSC endpoints, reduce internet-facing access where possible, and review logs for signs of exploitation attempts.
Jul 25, 2026
A critical unauthenticated remote code execution flaw in React Server Components, tracked as **CVE-2025-55182** and widely dubbed **React2Shell**, exposed React 19 server-side packages and downstream frameworks including **Next.js App Router**. The bug stems from unsafe deserialization in the RSC/Flight protocol, allowing a single crafted HTTP request to reach vulnerable server function paths and execute arbitrary code in default deployments, including some apps that did not explicitly define Server Function endpoints. React released fixes for `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in **19.0.1**, **19.1.2**, and **19.2.1**, while Next.js issued related guidance under **CVE-2025-66478** for affected 15.x, 16.x, and certain canary releases; vendors stressed that WAF rules and hosting-provider mitigations are only temporary and that patching and redeployment are required. Security firms and vendors reported rapid weaponization after disclosure, with public exploit code, Nuclei and Metasploit support, and confirmed in-the-wild exploitation against internet-facing Next.js and other RSC-enabled applications. Reported post-compromise activity included **XMRig** cryptominers, **Sliver**, **MeshAgent**, **Cobalt Strike**, **SNOWLIGHT**, **ShadowPAD**, credential theft targeting cloud and Kubernetes environments, and persistence mechanisms tied to multiple China-linked actors and other threat groups; CISA added the flaw to its **Known Exploited Vulnerabilities** catalog. Researchers estimated broad exposure across cloud environments and web assets, while Cloudflare, Akamai, Imperva, Google Cloud, and others deployed emergency protections, underscoring the scale and urgency of remediation.
Jul 23, 2026