markdown-mdx-content-pipeline-weapon

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.72). The required workflow ingests OUTSIDER-authored free text via the example “AI chat renderer” path where user-provided markdown is passed into renderChatMarkdown(markdown) and then transformed by the remark/rehype pipeline, meaning arbitrary user input becomes LLM-readable context (potentially including attacker instructions) before any sanitization/serialization; this is the “user-generated content” category.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The guide's Next.js client-side example dynamically imports and initializes remote Mermaid JS at runtime from https://cdn.jsdelivr.net/npm/mermaid/dist/mermaid.esm.min.mjs, which fetches and executes third-party code in the running app.