Cybersecuritynews

Critical RCE Vulnerability in -mdx-remote Library Affects React Servers

First seen 13 Feb 2026, 07:08 UTC • Discuss.Hashicorp

•78% similarity •68.3

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A critical vulnerability tracked as CVE-2026-0969 was disclosed in the -mdx-remote library, allowing attackers to execute arbitrary code on servers that render untrusted MDX content. The vulnerability affects versions 4.3.0 through 5.0.0 and has been addressed in version 6.0.0, which introduces a breaking change to mitigate the risk.

ThreatCluster AI

Timeline

2026-02-12

CVE-2026-0969 published

2026-02-13

Security advisory HCSEC-2026-01 released

Attack Flow

7 entities, 12 inferred relationships (STIX 2.1).

Technique (3)

Remote Code Execution
Zero-day Exploit
T1203 - Exploitation for Client Execution

Vulnerability (1)

CVE-2026-0969

Affected Platform (3)

Mdx-remote
React
TypeScript

Relationships

CVE-2026-0969 targets Mdx-remote
CVE-2026-0969 targets React
CVE-2026-0969 targets TypeScript
Remote Code Execution targets Mdx-remote
Remote Code Execution targets React
Remote Code Execution targets TypeScript
Zero-day Exploit targets Mdx-remote
Zero-day Exploit targets React
Zero-day Exploit targets TypeScript
T1203 - Exploitation for Client Execution targets Mdx-remote
T1203 - Exploitation for Client Execution targets React
T1203 - Exploitation for Client Execution targets TypeScript

Community

Browse all →

Tracked Entities in This Story

Mdx-remote React TypeScript Remote Code Execution Zero-day Exploit

Critical RCE Vulnerability in -mdx-remote Library Affects React Servers

Ask AI about this cluster

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story