HCSEC-2026-01 - Arbitrary code execution in React server

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in -mdx-remote Library Affects React Servers A critical vulnerability tracked as CVE-2026-0969 was disclosed in the -mdx-remote library, allowing attackers to execute arbitrary code on servers that render untrusted MDX content. The vulnerability affects versions 4.3.0 through 5.0.0 and has been addressed in version 6.0.0, which introduces a breaking change to mitigate the risk. 3 sources 68