A critical code injection vulnerability in the next-mdx-remote library allows authenticated attackers to achieve remote code execution on the underlying server.

The vulnerability is caused by improper control of code generation (CWE-94) within the serialize function. Attackers with low-level privileges can supply malicious MDX content that is executed by the server during the rendering process.

This vulnerability carries a CVSS score of 8.8, indicating a high risk to organizational security. Successful exploitation grants an attacker the ability to execute arbitrary code with the privileges of the application, potentially leading to full system compromise, unauthorized data access, and the ability to pivot into internal networks.

Immediate Action: Update the next-mdx-remote package to version 6.0.0 or later to ensure the serialize function correctly sanitizes input.

Proactive Monitoring: Review application logs for suspicious MDX input patterns or unexpected process execution spawned by the web server.

Compensating Controls: Implement strict input validation or use a Web Application Firewall (WAF) configured to inspect and block malicious MDX payloads before they reach the backend serialization logic.

Public Exploit Available: Unknown

Given the severity of potential remote code execution, organizations should prioritize the update to next-mdx-remote 6.0.0. Testing should be conducted in a staging environment to ensure the security patch does not impact existing MDX rendering workflows, followed by a rapid deployment to production systems.