Critical RCE Vulnerability Discovered in next-mdx-remote Library A severe security flaw (CVE-2026-0969) has been identified in next-mdx-remote, a widely used TypeScript library for rendering MDX content in React applications. Disclosed by HashiCorp on February 11, 2026, under bulletin HCSEC-2026-01, the vulnerability allows attackers to execute arbitrary code on servers processing untrusted MDX content. The issue stems from insufficient sanitization in the `serialize` function across versions 4.3.0 to 5.0.0, where JavaScript expressions are enabled. Exploitation occurs when malicious code is injected via user-supplied MDX content, granting remote code execution (RCE) capabilities. Applications permitting untrusted MDX input for server-side rendering are particularly at risk. HashiCorp has released version 6.0.0 to mitigate the threat, introducing a breaking change that disables JavaScript expressions by default (`blockJS: true`). For deployments requiring JavaScript expressions, the update includes `blockDangerousJS`, which restricts high-risk operations like `eval`, `Function`, and `require` when `blockJS` is disabled. The vulnerability was discovered by researchers at Sejong University. Organizations using affected versions are advised to upgrade immediately and review configurations to ensure JavaScript expressions are only enabled with proper safeguards.

A critical vulnerability in HashiCorp's Vault software, tracked as CVE-2025-6000, allows privileged operators to execute arbitrary code on underlying host systems. The flaw affects Vault versions from 0.8.0 up to 1.20.0 and has been patched in recent releases. Organizations are urged to immediately upgrade to fixed versions to mitigate the risk of exploitation.