CVE-2026-0969

High

Advisory

Published 12 Feb 2026In the index since 8 Sept 2026

next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
next-mdx-remotenpm	4.4.1, 5.0.0	6.0.0	2

2 by stars

Chart

Latest

Affected images

Radar Score

1 of the 3 container images this version deploys carry CVE-2026-0969.

Container image	Digest	Package	Fixed in
chibisafe/chibisafe :latest	836467a50792	next-mdx-remote@4.4.1	6.0.0

5,654

lobe-chathelm-charts-darox

1 of the 1 container images this version deploys carry CVE-2026-0969.

Container image	Digest	Package	Fixed in
lobehub/lobe-chat :1.96.9	da0c21fefcd3	next-mdx-remote@5.0.0	6.0.0

666

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
chibisafe/chibisafe :latest	836467a50792	next-mdx-remote@4.4.1	6.0.0	1
lobehub/lobe-chat :1.96.9	da0c21fefcd3	next-mdx-remote@5.0.0	6.0.0	1