diff --git a/app/pages/design-kit.vue b/app/pages/design-kit.vue
index 065b5db7a..b9727d8a9 100644
--- a/app/pages/design-kit.vue
+++ b/app/pages/design-kit.vue
@@ -35,7 +35,7 @@ defineOgImage('Docs.takumi', {
   <UPage v-if="pageData">
     <UPageHero
       :title="pageData.title"
-      :links="pageData.links"
+      :links="pickLinks(pageData.links)"
       :description="pageData.description"
       :ui="{
         title: 'text-left',
diff --git a/app/pages/docs/[...slug].vue b/app/pages/docs/[...slug].vue
index b60ced5ee..a8c055d58 100644
--- a/app/pages/docs/[...slug].vue
+++ b/app/pages/docs/[...slug].vue
@@ -317,10 +317,11 @@ const noRightAside = computed(() => route.path.includes('/examples/'))
         </UPageAside>
       </template>
       <UPageHeader
+        :title="fm.title"
+        :description="fm.description"
         :ui="{
           wrapper: 'flex-row items-center flex-wrap justify-between'
         }"
-        v-bind="fm"
       >
         <template #headline>
           <UBreadcrumb :items="breadcrumb" />
@@ -347,10 +348,10 @@ const noRightAside = computed(() => route.path.includes('/examples/'))
             color="neutral"
             variant="soft"
             :target="link.to.startsWith('http') ? '_blank' : undefined"
-            v-bind="{ ...link, size: 'sm' }"
+            v-bind="{ ...pickLink(link), size: 'sm' }"
           >
             <template v-if="link.avatar" #leading>
-              <UAvatar v-bind="link.avatar" size="2xs" :alt="`${link.label} avatar`" />
+              <UAvatar v-bind="pickAvatar(link.avatar)" size="2xs" :alt="`${link.label} avatar`" />
             </template>
           </UButton>
 
diff --git a/app/pages/enterprise/agencies/index.vue b/app/pages/enterprise/agencies/index.vue
index 1bd9a08c4..c32f834d7 100644
--- a/app/pages/enterprise/agencies/index.vue
+++ b/app/pages/enterprise/agencies/index.vue
@@ -46,7 +46,7 @@ await fetchList()
     <UPageHero
       :title="pageData.title"
       :description="pageData.description"
-      :links="pageData.links"
+      :links="pickLinks(pageData.links)"
     />
 
     <UContainer>
diff --git a/app/pages/enterprise/jobs.vue b/app/pages/enterprise/jobs.vue
index 7d21c89d1..38d4e765f 100644
--- a/app/pages/enterprise/jobs.vue
+++ b/app/pages/enterprise/jobs.vue
@@ -36,7 +36,7 @@ await fetchList()
     <UPageHero
       :title="pageData.title"
       :description="pageData.description"
-      :links="pageData.links"
+      :links="pickLinks(pageData.links)"
       :ui="{
         title: 'text-left',
         description: 'text-left',
diff --git a/app/pages/enterprise/sponsors.vue b/app/pages/enterprise/sponsors.vue
index 6073325a3..2f27fac2c 100644
--- a/app/pages/enterprise/sponsors.vue
+++ b/app/pages/enterprise/sponsors.vue
@@ -37,7 +37,7 @@ defineOgImage('Docs.takumi', {
     <UPageHero
       :title="pageData.title"
       :description="pageData.description"
-      :links="pageData.links"
+      :links="pickLinks(pageData.links)"
     />
 
     <UPageBody class="relative">
diff --git a/app/pages/index.vue b/app/pages/index.vue
index 36f4929ce..26edd339d 100644
--- a/app/pages/index.vue
+++ b/app/pages/index.vue
@@ -251,7 +251,7 @@ const isMounted = useMounted()
           :in-view-options="{ once: true }"
         >
           <UPageFeature
-            v-bind="feature"
+            v-bind="pickFeature(feature)"
             orientation="vertical"
           />
         </Motion>
@@ -283,7 +283,7 @@ const isMounted = useMounted()
       }"
     >
       <UUser
-        v-bind="pageData.testimonial.author"
+        v-bind="pickUser(pageData.testimonial.author)"
         size="xl"
         class="justify-center"
       />
@@ -412,7 +412,7 @@ const isMounted = useMounted()
               <p class="text-muted text-center">
                 {{ pageData.stats.community.description }}
               </p>
-              <UButton class="mt-4 w-fit" v-bind="pageData.stats.cta" />
+              <UButton class="mt-4 w-fit" v-bind="pickLink(pageData.stats.cta)" />
             </div>
           </UPageCard>
         </div>
@@ -451,7 +451,7 @@ const isMounted = useMounted()
 
     <UPageSection
       :description="pageData.modules.description"
-      :links="pageData.modules.links"
+      :links="pickLinks(pageData.modules.links)"
       :ui="{
         root: 'bg-linear-to-b border-t border-default from-muted dark:from-muted/40 to-default',
         title: 'text-left',
@@ -483,7 +483,7 @@ const isMounted = useMounted()
     <UPageSection
       :title="pageData.deploy.title"
       :description="pageData.deploy.description"
-      :links="pageData.deploy.links"
+      :links="pickLinks(pageData.deploy.links)"
       orientation="horizontal"
       :ui="{
         root: 'bg-linear-to-b border-t border-default from-muted dark:from-muted/40 to-default'
@@ -502,7 +502,7 @@ const isMounted = useMounted()
     <UPageSection
       :title="pageData.contributors.title"
       :description="pageData.contributors.description"
-      :links="pageData.contributors.links"
+      :links="pickLinks(pageData.contributors.links)"
       orientation="horizontal"
       reverse
       :ui="{
@@ -578,7 +578,7 @@ const isMounted = useMounted()
     <UPageSection
       :title="pageData.sponsors.title"
       :description="pageData.sponsors.description"
-      :links="pageData.sponsors.links"
+      :links="pickLinks(pageData.sponsors.links)"
       class="relative"
       :ui="{
         root: 'bg-linear-to-b border-t border-default from-muted dark:from-muted/40 to-default',
diff --git a/app/pages/newsletter.vue b/app/pages/newsletter.vue
index edebb7dcb..eeefc3f23 100644
--- a/app/pages/newsletter.vue
+++ b/app/pages/newsletter.vue
@@ -39,7 +39,12 @@ defineOgImage('Docs.takumi', {
 
     <UPageBody>
       <UContainer>
-        <UPageCTA v-bind="pageData.cta" />
+        <UPageCTA
+          :headline="pageData.cta.headline"
+          :title="pageData.cta.title"
+          :description="pageData.cta.description"
+          :links="pickLinks(pageData.cta.links)"
+        />
       </UContainer>
     </UPageBody>
   </UPage>
diff --git a/app/pages/templates.vue b/app/pages/templates.vue
index 5876eae68..20f1747ea 100644
--- a/app/pages/templates.vue
+++ b/app/pages/templates.vue
@@ -38,7 +38,7 @@ defineOgImage('Docs.takumi', {
     <UPageHero
       :title="pageData.title"
       :description="pageData.description"
-      :links="pageData.links"
+      :links="pickLinks(pageData.links)"
     />
     <UPageBody>
       <UContainer>
diff --git a/app/pages/video-courses.vue b/app/pages/video-courses.vue
index c3e572ac7..036bdc742 100644
--- a/app/pages/video-courses.vue
+++ b/app/pages/video-courses.vue
@@ -36,7 +36,7 @@ defineOgImage('Docs.takumi', {
     <UPageHero
       :title="pageData.title"
       :description="pageData.description"
-      :links="pageData.links"
+      :links="pickLinks(pageData.links)"
     />
     <UPageBody>
       <UContainer>
diff --git a/app/utils/content.ts b/app/utils/content.ts
index 80a53bce7..c3ef0ade7 100644
--- a/app/utils/content.ts
+++ b/app/utils/content.ts
@@ -1,4 +1,5 @@
 import type { NavigationItem } from 'comark-content'
+import type { AvatarProps, ButtonProps, PageFeatureProps, UserProps } from '@nuxt/ui'
 
 export function navPageFromPath(path: string, tree: NavigationItem[]): NavigationItem | undefined {
   for (const file of tree) {
@@ -96,3 +97,50 @@ export function listSurround(
 
   return [link(items?.[index - 1]), link(items?.[index + 1])]
 }
+
+/**
+ * Content data reaches components through these picks, never a `v-bind` spread.
+ * - Vue binds every unknown key to the DOM, so a spread lets content set any attribute.
+ * - Nuxt UI spreads each `links` item onto a `UButton`, each `authors` item onto a `UUser`…
+ * Keys are the ones content uses: add one here before content can set it.
+ */
+
+type ContentObject = Record<string, any> | null | undefined
+
+function pick<T>(data: ContentObject, keys: readonly string[]): T {
+  const picked: Record<string, unknown> = {}
+  for (const key of keys) {
+    if (data?.[key] !== undefined) picked[key] = data[key]
+  }
+  return picked as T
+}
+
+const AVATAR_KEYS = ['src', 'srcset', 'alt', 'text', 'icon', 'provider', 'loading']
+const LINK_KEYS = ['label', 'to', 'target', 'title', 'icon', 'leadingIcon', 'trailingIcon', 'trailing', 'color', 'variant', 'size', 'download', 'external']
+const FEATURE_KEYS = ['title', 'description', 'icon', 'to', 'target']
+const USER_KEYS = ['name', 'description', 'to', 'target']
+
+export function pickAvatar(avatar: ContentObject): AvatarProps | undefined {
+  return avatar ? pick<AvatarProps>(avatar, AVATAR_KEYS) : undefined
+}
+
+export function pickLink(link: ContentObject): ButtonProps {
+  const picked = pick<ButtonProps>(link, LINK_KEYS)
+  if (link?.avatar) picked.avatar = pickAvatar(link.avatar)
+  return picked
+}
+
+/** `undefined` stays `undefined`, so components still skip an absent `links`. */
+export function pickLinks(links: ContentObject[] | null | undefined): ButtonProps[] | undefined {
+  return links?.map(pickLink)
+}
+
+export function pickFeature(feature: ContentObject): PageFeatureProps {
+  return pick<PageFeatureProps>(feature, FEATURE_KEYS)
+}
+
+export function pickUser(user: ContentObject): UserProps {
+  const picked = pick<UserProps>(user, USER_KEYS)
+  if (user?.avatar) picked.avatar = pickAvatar(user.avatar)
+  return picked
+}
diff --git a/package.json b/package.json
index 335bb7fe0..61ae8562e 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "@chat-adapter/discord": "^4.42.0",
     "@chat-adapter/state-memory": "^4.42.0",
     "@chat-adapter/state-redis": "^4.42.0",
-    "@comark/nuxt": "^0.7.0",
+    "@comark/nuxt": "^0.8.1",
     "@iconify-json/heroicons": "^1.2.3",
     "@iconify-json/logos": "^1.2.17",
     "@iconify-json/lucide": "^1.2.146",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index dc1f34379..27c26d7e1 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -163,6 +163,7 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
+  comark: 0.8.1
   nostics: ^1.3.0
   chat>@workflow/serde: 4.1.2
   '@ai-sdk/provider-utils>@workflow/serde': 4.1.2
@@ -184,8 +185,8 @@ importers:
         specifier: ^4.42.0
         version: 4.42.0(@opentelemetry/api@1.9.1)(ai@7.0.143(zod@4.6.7))(supports-color@8.1.1)(workflow@5.2.2(@aws-sdk/credential-provider-web-identity@3.972.49)(@nestjs/common@12.1.3(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@8.1.1))(@nestjs/core@12.1.3(@nestjs/common@12.1.3(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@8.1.1))(reflect-metadata@0.2.2)(rxjs@7.8.2))(@opentelemetry/api@1.9.1)(@swc/cli@0.8.1(@swc/core@1.15.3(@swc/helpers@0.5.23))(chokidar@5.0.0)(supports-color@8.1.1))(@swc/core@1.15.3(@swc/helpers@0.5.23))(@swc/helpers@0.5.23)(magicast@0.5.5)(react@19.3.0)(supports-color@8.1.1)(typescript@6.0.3)(ws@8.22.0))(zod@4.6.7)
       '@comark/nuxt':
-        specifier: ^0.7.0
-        version: 0.7.0(magicast@0.5.5)(nuxt@4.6.2(e23abfa95f47d2654a3d6b3d5c49ae8e))(rangi@2.2.0)(shiki@4.5.0)(vue@3.5.44(typescript@6.0.3))
+        specifier: ^0.8.1
+        version: 0.8.1(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(e23abfa95f47d2654a3d6b3d5c49ae8e))(oxc-parser@0.151.0)(rangi@2.2.0)(rolldown@1.2.14)(shiki@4.5.0)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.14)(rollup@4.63.5)(vite@8.3.4(@types/node@26.6.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)))(vue@3.5.44(typescript@6.0.3))
       '@iconify-json/heroicons':
         specifier: ^1.2.3
         version: 1.2.3
@@ -426,7 +427,7 @@ importers:
         version: 0.7.8
       nuxt-agent-discovery:
         specifier: ^0.7.1
-        version: 0.7.1(ebd823c318e9004e6fa58cb81a14b37a)
+        version: 0.7.1(a4441280dfd705fb6f034e0d4b552f88)
       nuxtseo-layer-devtools:
         specifier: ^5.3.16
         version: 5.3.16(70bf15f76a8567a5b548344f8a380718)
@@ -746,18 +747,18 @@ packages:
   '@colordx/core@7.3.0':
     resolution: {integrity: sha512-LVzTTPhX7wpy7TkGjouA9zbbCBIw92RGm7ZQqSKFE0oYE3sMx2FGXz90eVpgw7k/+wrrY+qJ86nHXifZWMS5jA==}
 
-  '@comark/nuxt@0.7.0':
-    resolution: {integrity: sha512-cbYIw7EVp8ZjTgkS3Q/M1av0T+odX/vTdDd865IPDX/Fmtv1pNLg4TxrHTC3w4z9zFq5Gmyu4U1sbirqmSKIfg==}
+  '@comark/nuxt@0.8.1':
+    resolution: {integrity: sha512-Kc3SVGjKYfNN4h4dm9SNnQKnMl+bp/PvrZ11WU7qCl8ohdxyl5gjEbjhLT223TzSmbHvCtmxzlK/hXsUHXGA2Q==}
     peerDependencies:
       nuxt: ^4.0.0
 
-  '@comark/vue@0.7.0':
-    resolution: {integrity: sha512-C63ObcCAiM5DKVDhWPz27pCRsvl0IG9XZJDGjFef1h/V4kS6lEjsoyepLdl4pvAPoSn6U0oGiJTgHLj5GCw2rQ==}
+  '@comark/vue@0.8.1':
+    resolution: {integrity: sha512-zMxShbPfynnSU5AWH7IeXe2RYm8YIqb5r5XC6eX2Rzv5Ed3/jypbCwp2o1JZAEV0/S3Mczil7Nnb0mzMaOAvHA==}
     peerDependencies:
       beautiful-mermaid: ^1.1.3
-      katex: ^0.17.0
-      shiki: ^4.3.1
-      vue: ^3.5.0
+      katex: ^0.18.7
+      shiki: ^4.4.3
+      vue: ^3.5.43
     peerDependenciesMeta:
       beautiful-mermaid:
         optional: true
@@ -2326,6 +2327,36 @@ packages:
     resolution: {integrity: sha512-ZUlZ5iYfyfJFDPluhn6ZxFWcsuxWbLnZBc8w3MAROcQ4lYfZ+qFpALBLSNlpc0zhOa++33EE+5PEbOAdVIY+dw==}
     engines: {node: '>=18.12.0'}
 
+  '@nuxt/kit@4.6.1':
+    resolution: {integrity: sha512-ld5+/o4EMqyw6Qy+SdEYkezfprS87+p+xOBhnQgXwyrg1EdtILfLeudQ+hX6UyCnsoF6o0SOw3pjN1P4Tg9O0w==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    peerDependencies:
+      '@nuxt/schema': ^3.0.0 || ^4.0.0 || ^5.0.0-0
+      confbox: '>=0.1.0'
+      dotenv: '*'
+      giget: '>=3.1.0'
+      jiti: ^2.0.0
+      mlly: ^1.2.0
+      oxc-parser: '>=0.56.0'
+      rolldown: '>=1.0.0'
+    peerDependenciesMeta:
+      '@nuxt/schema':
+        optional: true
+      confbox:
+        optional: true
+      dotenv:
+        optional: true
+      giget:
+        optional: true
+      jiti:
+        optional: true
+      mlly:
+        optional: true
+      oxc-parser:
+        optional: true
+      rolldown:
+        optional: true
+
   '@nuxt/kit@4.6.2':
     resolution: {integrity: sha512-Vn9DJobc30WdR1vrlRcEAFSFy7NV5CWq3o6gxsfrdGb2FmCh0fuDyvbZC30rm2enyiPaOUPafKctFE/ToBjybw==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -2667,6 +2698,7 @@ packages:
   '@opentelemetry/sdk-trace-base@2.11.0':
     resolution: {integrity: sha512-H19x/TX/LZdqiYOjM7fqtSxwlplC5pgelavqbQdHbhdq0q/AI/TGkM2dfGuuynTXmJPeF2HoZVoPDu+TGoW78A==}
     engines: {node: ^18.19.0 || >=20.6.0}
+    deprecated: Use @opentelemetry/sdk-trace package
     peerDependencies:
       '@opentelemetry/api': '>=1.3.0 <1.10.0'
 
@@ -6173,13 +6205,13 @@ packages:
     resolution: {integrity: sha512-z0nuo3PM53FwBYbxP4rNrUo1QW7jv8YO44HDYaGm2Wx4pmHsLqKdsA6CiHcSOaURze6m7my0Z0YFaLL77LtDUA==}
     hasBin: true
 
-  comark@0.7.0:
-    resolution: {integrity: sha512-680hLtUOBcvBEJCD+iCU20jk5TrIJlIcE6X4npdC4x7LBhCvmiYJgByozR2fKav6DYw7AYoXsJVae65kXV6Qhw==}
+  comark@0.8.1:
+    resolution: {integrity: sha512-oz2Nrt3o/e5SRYVgd3PlBwDUp5P4PWYZbVggORI02rLF63WEjHYkPJkxZh2Hwfpl0J4jDLspe6aeUraNplAsAw==}
     peerDependencies:
       beautiful-mermaid: ^1.1.3
-      katex: ^0.17.0
+      katex: ^0.18.7
       rangi: ^2.2.0
-      shiki: ^4.3.1
+      shiki: ^4.4.3
     peerDependenciesMeta:
       beautiful-mermaid:
         optional: true
@@ -6701,22 +6733,6 @@ packages:
   dom-accessibility-api@0.5.16:
     resolution: {integrity: sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==}
 
-  dom-serializer@3.1.1:
-    resolution: {integrity: sha512-4MEa38/QexBob6gFNwu+EGdWvhJ1OKuNwdYY3Y3NyeWDQfnGeDYQUDfIRzWu5B5gsv03so2Uxd28YC6zrsx3Lw==}
-    engines: {node: '>=20.19.0'}
-
-  domelementtype@3.0.0:
-    resolution: {integrity: sha512-umCQid3jKbDmVjx8jGaW7uUykm4DEUeyV21hPxNMo2nV955DhUThwqyOIDtreepP31hl84X7G5U9ZfsWvIB3Pg==}
-    engines: {node: '>=20.19.0'}
-
-  domhandler@6.0.1:
-    resolution: {integrity: sha512-gYzvtM72ZtxQO0T048kd6HWSbbGCNOUwcnfQ01cqIJ4X2IYKFFHZ5mKvrQETcFXxsRObZulDaKmy//R7TPtsBg==}
-    engines: {node: '>=20.19.0'}
-
-  domutils@4.0.2:
-    resolution: {integrity: sha512-qI4JLRKnSzqFqr7hAlS5xQDusBCjKSEG4t4+7aNrIQMHBcsC2TGEhuyABJdYkgSewL57PNLYEiibY2iPKhKpaA==}
-    engines: {node: '>=20.19.0'}
-
   dot-prop@10.2.0:
     resolution: {integrity: sha512-BTJ9aZYL3vCfZlZOBLy9v8TUqWGQ0pzFnygKwFZt5udj6viBoFIBviKPUoZLDCPn1FoXffv6McQFDenrm5Krfw==}
     engines: {node: '>=20'}
@@ -7958,10 +7974,6 @@ packages:
   html-whitespace-sensitive-tag-names@3.0.1:
     resolution: {integrity: sha512-q+310vW8zmymYHALr1da4HyXUQ0zgiIwIicEfotYPWGN0OJVEN/58IJ3A4GBYcEq3LGAZqKb+ugvP0GNB9CEAA==}
 
-  htmlparser2@12.0.0:
-    resolution: {integrity: sha512-Tz7u1i95/g2x2jz81+x0FBVhBhY5aRTvD3tXXdFaljuNdzDLJ8UGNRrTcj2cgQvAg3iW/h77Fz15nLW0L0CrZw==}
-    engines: {node: '>=20.19.0'}
-
   http-cache-semantics@4.3.0:
     resolution: {integrity: sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA==}
 
@@ -8757,8 +8769,8 @@ packages:
     resolution: {integrity: sha512-Y1Q1+UP9WXou0DUrnaFdDsoMqiMCWy6aS968IBUaQ2eZi6H1/kPCfpfZOWXFJZbeKMkX9Wo6OFzY/k48qqPf3Q==}
     engines: {node: '>=16.14.0', npm: '>=8.1.0'}
 
-  markdown-exit@1.1.0-beta.2:
-    resolution: {integrity: sha512-8CzMGVlFZ4DEfnc8KU+4ycUW2SIOuiXqCHD7z51ecVEi/weyc0f2ylQbCm4KoKuVlTZSuMUMnWT0hTyquZ7anQ==}
+  markdown-exit@1.3.0:
+    resolution: {integrity: sha512-bsqlcm3Hk1ukcG1Al83pp3JjVobu4w1mpZz47OzLw8bCY8XchkCX+PXC32l2TH4nZ7p5WFg2NwpnLDXkY1X7Yw==}
 
   markdown-table@3.0.4:
     resolution: {integrity: sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw==}
@@ -9186,7 +9198,7 @@ packages:
       '@nuxtjs/mcp-toolkit': '>=0.19.0'
       '@nuxtjs/robots': ^6.0.0
       '@nuxtjs/sitemap': ^8.0.0
-      comark: ^0.6.0
+      comark: 0.8.1
       nuxt-llms: '>=0.1.0'
     peerDependenciesMeta:
       '@nuxt/content':
@@ -12147,23 +12159,32 @@ snapshots:
 
   '@colordx/core@7.3.0': {}
 
-  '@comark/nuxt@0.7.0(magicast@0.5.5)(nuxt@4.6.2(e23abfa95f47d2654a3d6b3d5c49ae8e))(rangi@2.2.0)(shiki@4.5.0)(vue@3.5.44(typescript@6.0.3))':
+  '@comark/nuxt@0.8.1(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(e23abfa95f47d2654a3d6b3d5c49ae8e))(oxc-parser@0.151.0)(rangi@2.2.0)(rolldown@1.2.14)(shiki@4.5.0)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.14)(rollup@4.63.5)(vite@8.3.4(@types/node@26.6.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)))(vue@3.5.44(typescript@6.0.3))':
     dependencies:
-      '@comark/vue': 0.7.0(rangi@2.2.0)(shiki@4.5.0)(vue@3.5.44(typescript@6.0.3))
-      '@nuxt/kit': 4.4.8(magicast@0.5.5)
-      comark: 0.7.0(rangi@2.2.0)(shiki@4.5.0)
+      '@comark/vue': 0.8.1(rangi@2.2.0)(shiki@4.5.0)(vue@3.5.44(typescript@6.0.3))
+      '@nuxt/kit': 4.6.1(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.151.0)(rolldown@1.2.14)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.14)(rollup@4.63.5)(vite@8.3.4(@types/node@26.6.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)))
+      comark: 0.8.1(rangi@2.2.0)(shiki@4.5.0)
       nuxt: 4.6.2(e23abfa95f47d2654a3d6b3d5c49ae8e)
     transitivePeerDependencies:
+      - '@nuxt/schema'
       - beautiful-mermaid
+      - confbox
+      - dotenv
+      - giget
+      - jiti
       - katex
-      - magicast
+      - magic-string
+      - mlly
+      - oxc-parser
       - rangi
+      - rolldown
       - shiki
+      - unplugin
       - vue
 
-  '@comark/vue@0.7.0(rangi@2.2.0)(shiki@4.5.0)(vue@3.5.44(typescript@6.0.3))':
+  '@comark/vue@0.8.1(rangi@2.2.0)(shiki@4.5.0)(vue@3.5.44(typescript@6.0.3))':
     dependencies:
-      comark: 0.7.0(rangi@2.2.0)(shiki@4.5.0)
+      comark: 0.8.1(rangi@2.2.0)(shiki@4.5.0)
       vue: 3.5.44(typescript@6.0.3)
     optionalDependencies:
       shiki: 4.5.0
@@ -13995,6 +14016,39 @@ snapshots:
     transitivePeerDependencies:
       - magicast
 
+  '@nuxt/kit@4.6.1(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.151.0)(rolldown@1.2.14)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.14)(rollup@4.63.5)(vite@8.3.4(@types/node@26.6.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)))':
+    dependencies:
+      consola: 3.4.2
+      defu: 6.1.7
+      destr: 2.0.5
+      errx: 0.2.2
+      exsolve: 1.1.3
+      ignore: 7.0.12
+      klona: 2.0.6
+      microdiff: 1.6.0
+      nostics: 1.3.0
+      package-manager-detector: 1.9.0
+      pathe: 2.0.3
+      rc9: 3.1.0
+      scule: 1.3.0
+      std-env: 4.3.0
+      tinyexec: 1.3.1
+      tinyglobby: 0.2.17
+      unctx: 3.0.1(magic-string@1.4.3)(oxc-parser@0.151.0)(rolldown@1.2.14)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.14)(rollup@4.63.5)(vite@8.3.4(@types/node@26.6.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)))
+      verkit: 0.5.0
+    optionalDependencies:
+      '@nuxt/schema': 4.6.2
+      confbox: 0.3.1
+      dotenv: 17.4.2
+      giget: 3.3.1
+      jiti: 2.7.0
+      mlly: 1.8.2
+      oxc-parser: 0.151.0
+      rolldown: 1.2.14
+    transitivePeerDependencies:
+      - magic-string
+      - unplugin
+
   '@nuxt/kit@4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@0.30.21)(mlly@1.8.2)(oxc-parser@0.139.0)(rolldown@1.2.14)(unplugin@2.3.11)':
     dependencies:
       consola: 3.4.2
@@ -18211,7 +18265,7 @@ snapshots:
   comark-content@0.4.1(@vercel/functions@3.10.1(@aws-sdk/credential-provider-web-identity@3.972.49)(ws@8.22.0))(db0@0.3.4(@libsql/client@0.18.0)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260702.1)(@libsql/client@0.18.0)(@opentelemetry/api@1.9.1)))(ioredis@5.11.1(supports-color@8.1.1))(rangi@2.2.0)(shiki@4.5.0):
     dependencies:
       citty: 0.2.2
-      comark: 0.7.0(rangi@2.2.0)(shiki@4.5.0)
+      comark: 0.8.1(rangi@2.2.0)(shiki@4.5.0)
       hookable: 6.1.2
       jiti: 2.7.0
       ofetch: 1.5.1
@@ -18245,12 +18299,11 @@ snapshots:
       - shiki
       - uploadthing
 
-  comark@0.7.0(rangi@2.2.0)(shiki@4.5.0):
+  comark@0.8.1(rangi@2.2.0)(shiki@4.5.0):
     dependencies:
       entities: 8.1.0
-      htmlparser2: 12.0.0
       js-yaml: 5.4.2
-      markdown-exit: 1.1.0-beta.2
+      markdown-exit: 1.3.0
     optionalDependencies:
       rangi: 2.2.0
       shiki: 4.5.0
@@ -18743,24 +18796,6 @@ snapshots:
 
   dom-accessibility-api@0.5.16: {}
 
-  dom-serializer@3.1.1:
-    dependencies:
-      domelementtype: 3.0.0
-      domhandler: 6.0.1
-      entities: 8.1.0
-
-  domelementtype@3.0.0: {}
-
-  domhandler@6.0.1:
-    dependencies:
-      domelementtype: 3.0.0
-
-  domutils@4.0.2:
-    dependencies:
-      dom-serializer: 3.1.1
-      domelementtype: 3.0.0
-      domhandler: 6.0.1
-
   dot-prop@10.2.0:
     dependencies:
       type-fest: 5.10.0
@@ -20200,13 +20235,6 @@ snapshots:
   html-whitespace-sensitive-tag-names@3.0.1:
     optional: true
 
-  htmlparser2@12.0.0:
-    dependencies:
-      domelementtype: 3.0.0
-      domhandler: 6.0.1
-      domutils: 4.0.2
-      entities: 8.1.0
-
   http-cache-semantics@4.3.0: {}
 
   http-errors@2.0.1:
@@ -20952,7 +20980,7 @@ snapshots:
       quickselect: 3.0.0
       tinyqueue: 3.0.0
 
-  markdown-exit@1.1.0-beta.2:
+  markdown-exit@1.3.0:
     dependencies:
       '@types/linkify-it': 5.0.0
       '@types/mdurl': 2.0.0
@@ -21737,7 +21765,7 @@ snapshots:
     dependencies:
       boolbase: 1.0.0
 
-  nuxt-agent-discovery@0.7.1(ebd823c318e9004e6fa58cb81a14b37a):
+  nuxt-agent-discovery@0.7.1(a4441280dfd705fb6f034e0d4b552f88):
     dependencies:
       '@nuxt/kit': 4.6.2(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.151.0)(rolldown@1.2.14)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.14)(rollup@4.63.5)(vite@8.3.4(@types/node@26.6.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)))
       defu: 6.1.7
@@ -21749,6 +21777,7 @@ snapshots:
       '@nuxtjs/mcp-toolkit': 0.24.2(@nuxt/schema@4.6.2)(@vue/compiler-sfc@3.5.44)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(h3@1.15.11)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.151.0)(rolldown@1.2.14)(rollup@4.63.5)(supports-color@8.1.1)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.14)(rollup@4.63.5)(vite@8.3.4(@types/node@26.6.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)))(vite@8.3.4(@types/node@26.6.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1))(vue@3.5.44(typescript@6.0.3))(zod@4.6.7)
       '@nuxtjs/robots': 6.2.4(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(e23abfa95f47d2654a3d6b3d5c49ae8e))(oxc-parser@0.151.0)(rolldown@1.2.14)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.14)(rollup@4.63.5)(vite@8.3.4(@types/node@26.6.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)))(vite@8.3.4(@types/node@26.6.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1))(vue@3.5.44(typescript@6.0.3))(zod@4.6.7)
       '@nuxtjs/sitemap': 8.6.2(@nuxt/schema@4.6.2)(@oxc-project/types@0.151.0)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(nuxt@4.6.2(e23abfa95f47d2654a3d6b3d5c49ae8e))(rolldown@1.2.14)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.14)(rollup@4.63.5)(vite@8.3.4(@types/node@26.6.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)))(vite@8.3.4(@types/node@26.6.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1))(vue@3.5.44(typescript@6.0.3))(zod@4.6.7)
+      comark: 0.8.1(rangi@2.2.0)(shiki@4.5.0)
       nuxt-llms: https://pkg.pr.new/nuxt-content/nuxt-llms/nuxt-llms@f6a9730(@nuxt/schema@4.6.2)(confbox@0.3.1)(dotenv@17.4.2)(giget@3.3.1)(jiti@2.7.0)(magic-string@1.4.3)(mlly@1.8.2)(oxc-parser@0.151.0)(rolldown@1.2.14)(unplugin@3.4.0(esbuild@0.28.2)(rolldown@1.2.14)(rollup@4.63.5)(vite@8.3.4(@types/node@26.6.3)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(tsx@4.23.15)(yaml@2.9.1)))
     transitivePeerDependencies:
       - '@nuxt/schema'
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 5b9f70797..e8f9e126c 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -2,6 +2,9 @@ shamefullyHoist: true
 strictPeerDependencies: false
 
 overrides:
+  # TODO: drop once comark-content accepts comark 0.8 (0.4.1 requires `^0.7.0`).
+  # One copy: comark-content's parser runs the plugins we build from comark.
+  comark: 0.8.1
   nostics: ^1.3.0
   # chat@4.34.0 pins the 4.1.0-beta.2 prerelease, flagged as a downgrade by check-provenance.
   # Scoped to `chat`: `workflow` needs its own `@workflow/serde` major.
@@ -33,3 +36,15 @@ minimumReleaseAgeExclude:
   - nuxt-agent-discovery@0.5.0
   - cssnano-utils@8.2.0
   - "@nuxtjs/mcp-toolkit@0.24.1"
+  - comark@0.8.1
+  - "@comark/vue@0.8.1"
+  - "@comark/nuxt@0.8.1"
+permissions:
+  '@nuxtjs/sitemap':
+    skills: false
+  nuxt-og-image:
+    skills: false
+  nuxt-schema-org:
+    skills: false
+  nuxtseo-layer-devtools:
+    skills: false
diff --git a/server/utils/content/cache.ts b/server/utils/content/cache.ts
index 871f35618..615bf354f 100644
--- a/server/utils/content/cache.ts
+++ b/server/utils/content/cache.ts
@@ -17,7 +17,7 @@ function cacheAvailable(): boolean {
 /**
  * Bump when content parser/plugin changes (TODO: automate this)
  */
-export const CONTENT_PARSER_VERSION = 'v7'
+export const CONTENT_PARSER_VERSION = 'v9'
 
 /**
  * Driver backing one instance's manifest, parsed bodies and snapshot artifacts.
diff --git a/server/utils/content/plugins/index.ts b/server/utils/content/plugins/index.ts
index 6aa339a14..8fc6f5611 100644
--- a/server/utils/content/plugins/index.ts
+++ b/server/utils/content/plugins/index.ts
@@ -9,10 +9,25 @@ import { dottedFrontmatter } from './dotted-frontmatter'
 import { docsLinks } from './docs-links'
 import { cliDocs } from './cli-docs'
 import { configDocs } from './config-docs'
+import { sanitizeData } from './sanitize-data'
 import type { CliDocVersion } from '../../../../shared/utils/cli'
 import type { DocVersion } from '../../../../shared/utils/docs'
 import type { ContentInstanceKey } from '../../../../shared/utils/content'
 
+/** One policy for Markdown (`security()`) and every file's data (`sanitizeData()`). */
+export const SECURITY_OPTIONS = {
+  blockedTags: ['script', 'iframe', 'embed', 'form', 'base', 'meta', 'link', 'style'],
+  allowDataImages: false
+}
+
+/** Sanitizes Markdown bodies and their frontmatter, on a full parse. */
+const securityPlugin = security(SECURITY_OPTIONS)
+
+/**
+ * Sanitizes every file's data (YAML not handled by `security()`)
+ */
+export const sanitizePlugin = sanitizeData(SECURITY_OPTIONS)
+
 /**
  * The comark plugin chain every instance parses markdown with.
  * Bump `CONTENT_PARSER_VERSION` when it changes: cached bodies keep the old output.
@@ -21,10 +36,7 @@ export const comarkPlugins = [
   highlightPlugin,
   toc({ depth: 3 }),
   emoji(),
-  security({
-    blockedTags: ['script', 'iframe', 'embed', 'form', 'base', 'meta', 'link', 'style'],
-    allowDataImages: false
-  })
+  securityPlugin
 ]
 
 /** Per-instance plugins, on top of the shared `markdown()`/`yaml()`/`json()` chain. */
diff --git a/server/utils/content/plugins/sanitize-data.ts b/server/utils/content/plugins/sanitize-data.ts
new file mode 100644
index 000000000..ed24e8ee8
--- /dev/null
+++ b/server/utils/content/plugins/sanitize-data.ts
@@ -0,0 +1,86 @@
+import { sanitizeData as sanitizeWithComark, type SanitizeDataOptions } from 'comark/utils'
+import type { ContentPlugin } from 'comark-content'
+
+/**
+ * comark's `security()` sanitizes frontmatter on a full Markdown parse only. It misses:
+ * - YAML and JSON files, which never go through comark
+ * - partial loads (listings, navigation), which read frontmatter without comark's plugins
+ * - keys plugins rewrite after comark: `dottedFrontmatter()` turns `hero.^onclick` into `hero: { '^onclick' }`
+ */
+
+const UNSAFE_PROTOCOLS = new Set(['javascript:', 'vbscript:', 'data:'])
+
+function isUnsafeUrl(value: string): boolean {
+  if (!value.includes(':')) return false
+
+  try {
+    return UNSAFE_PROTOCOLS.has(new URL(value).protocol)
+  } catch {
+    // Relative: no protocol to abuse.
+    return false
+  }
+}
+
+/**
+ * Delete script URLs under any key from `data` in place, returning the dotted paths it removed.
+ * comark only checks URL keys (`to`, `*url`, `*link`…), but templates bind others as links: `template.demo`, `providerData.website`.
+ * The price: prose opening with `javascript:` goes too.
+ */
+function stripUnsafeUrls(data: unknown): string[] {
+  const removed: string[] = []
+  // YAML aliases can share or nest an object.
+  const seen = new WeakSet<object>()
+
+  const walk = (value: unknown, path: string) => {
+    if (value === null || typeof value !== 'object' || seen.has(value)) return
+    seen.add(value)
+
+    let deleted = false
+    for (const [key, child] of Object.entries(value)) {
+      const at = path ? `${path}.${key}` : key
+      if (typeof child === 'string' && isUnsafeUrl(child)) {
+        Reflect.deleteProperty(value, key)
+        removed.push(at)
+        deleted = true
+      } else {
+        walk(child, at)
+      }
+    }
+
+    // A deleted item leaves a hole, which serialises as `null` and breaks `v-for` templates.
+    if (deleted && Array.isArray(value)) {
+      value.splice(0, value.length, ...value.filter(() => true))
+    }
+  }
+  walk(data, '')
+
+  return removed
+}
+
+/**
+ * Delete unsafe entries from `data` in place: comark's rules, then script URLs under any key.
+ * Returns the dotted paths it removed.
+ */
+export function stripUnsafeData(data: unknown, options: SanitizeDataOptions): string[] {
+  return [...sanitizeWithComark(data, options), ...stripUnsafeUrls(data)]
+}
+
+/**
+ * Strip unsafe entries from every file's data.
+ * Register it last: `file:parsed` hooks run in order, so it sees what the other plugins produced.
+ */
+export function sanitizeData(options: SanitizeDataOptions): ContentPlugin {
+  return {
+    name: 'nuxt-sanitize-data',
+    setup(content) {
+      content.hooks.hook('file:parsed', ({ file }) => {
+        if (!file) return
+
+        const removed = stripUnsafeData(file.data, options)
+        if (import.meta.dev && removed.length) {
+          content.logger.warn('sanitize-data', `${file.meta.key}: removed unsafe ${removed.map(path => `\`${path}\``).join(', ')}`)
+        }
+      })
+    }
+  }
+}
diff --git a/test/unit/content-sanitize-data.spec.ts b/test/unit/content-sanitize-data.spec.ts
new file mode 100644
index 000000000..c2cdc4803
--- /dev/null
+++ b/test/unit/content-sanitize-data.spec.ts
@@ -0,0 +1,162 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import fs from 'comark-content/sources/fs'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createBuildInstance } from '../../utils/factory'
+import { SECURITY_OPTIONS, sanitizePlugin } from '../../server/utils/content/plugins'
+import { stripUnsafeData } from '../../server/utils/content/plugins/sanitize-data'
+
+/** Strip `data` with the chain's policy, returning what's left and what went. */
+function strip<T>(data: T) {
+  const removed = stripUnsafeData(data, SECURITY_OPTIONS)
+  return { data, removed }
+}
+
+describe('stripUnsafeData', () => {
+  it('applies comark\'s rules at any depth', () => {
+    expect(strip({
+      'title': 'Page',
+      'innerHTML': '<b>x</b>',
+      '^onclick': 'x()',
+      'links': [{ label: 'Docs', labelHtml: '<b>x</b>', to: 'javascript:void(0)' }],
+      'hero': { as: 'script', card: { is: 'object' } }
+    })).toEqual({
+      data: { title: 'Page', links: [{ label: 'Docs' }], hero: { card: {} } },
+      removed: ['innerHTML', '^onclick', 'links.0.labelHtml', 'links.0.to', 'hero.as', 'hero.card.is']
+    })
+  })
+
+  it('drops script URLs under any key, which comark leaves to URL keys', () => {
+    expect(strip({ template: { demo: 'javascript:void(0)', repo: 'nuxt/starter' }, provider: { website: 'data:text/html,x' } }))
+      .toEqual({
+        data: { template: { repo: 'nuxt/starter' }, provider: {} },
+        removed: ['template.demo', 'provider.website']
+      })
+  })
+
+  it('keeps every URL a page links to', () => {
+    const links = [
+      { to: '/docs/4.x/getting-started' },
+      { to: '#usage' },
+      { to: 'https://github.com/nuxt/nuxt' },
+      { href: 'mailto:hello@nuxt.com' },
+      { src: '/assets/blog/cover.png' },
+      { website: 'https://vercel.com' }
+    ]
+
+    expect(strip({ links: structuredClone(links) })).toEqual({ data: { links }, removed: [] })
+  })
+
+  it('drops prose opening with a script scheme, the price of checking every key', () => {
+    expect(strip({ title: 'JavaScript: the good parts', description: 'Use javascript:void(0) sparingly' }))
+      .toEqual({ data: { description: 'Use javascript:void(0) sparingly' }, removed: ['title'] })
+  })
+
+  it('closes the hole a dropped array item leaves', () => {
+    const { data, removed } = strip({ tags: ['nuxt', 'javascript:void(0)', 'vue'] })
+
+    expect(data.tags).toEqual(['nuxt', 'vue'])
+    expect(removed).toEqual(['tags.1'])
+  })
+
+  it('walks a shared or nested object once', () => {
+    const template: Record<string, unknown> = { title: 'Starter', demo: 'javascript:void(0)' }
+    template.self = template
+
+    expect(strip({ templates: [template, template] }).removed).toEqual(['templates.0.demo'])
+  })
+
+  it('leaves scalars and safe data untouched', () => {
+    const page = { title: 'Installation', navigation: { icon: 'i-lucide-play' }, links: [{ label: 'Source', to: 'https://github.com/nuxt/nuxt', icon: 'i-simple-icons-github' }], date: new Date(0) }
+
+    expect(strip(structuredClone(page))).toEqual({ data: page, removed: [] })
+    expect(strip('hello')).toEqual({ data: 'hello', removed: [] })
+    expect(strip(null)).toEqual({ data: null, removed: [] })
+  })
+})
+
+describe('sanitizePlugin', () => {
+  function setupPlugin() {
+    let onParsed: ((ctx: any) => void) | undefined
+    sanitizePlugin.setup!({
+      logger: { warn: vi.fn() },
+      hooks: { hook: (name: string, fn: (ctx: any) => void) => void (name === 'file:parsed' && (onParsed = fn)) }
+    } as never)
+
+    return (ctx: any) => onParsed!(ctx)
+  }
+
+  it('strips a parsed file\'s data', () => {
+    const fireFileParsed = setupPlugin()
+    const file = { data: { title: 'Page', innerHTML: '<b>x</b>' }, meta: { key: 'docs/1.page.md' } }
+
+    fireFileParsed({ file })
+    expect(file.data).toEqual({ title: 'Page' })
+  })
+
+  it('ignores a rejected parse', () => {
+    const fireFileParsed = setupPlugin()
+
+    expect(() => fireFileParsed({ file: null })).not.toThrow()
+  })
+})
+
+describe('sanitizePlugin in the instance chain', () => {
+  let dir: string | undefined
+
+  beforeEach(() => {
+    // comark's `security()` warns about each frontmatter key it removes.
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+  })
+
+  afterEach(async () => {
+    vi.restoreAllMocks()
+    if (dir) await rm(dir, { recursive: true, force: true })
+    dir = undefined
+  })
+
+  it('runs after the other plugins, on the data a page reads', async () => {
+    dir = await mkdtemp(join(tmpdir(), 'nuxt-sanitize-'))
+    // A dotted key only becomes `navigation.onclick` once `dottedFrontmatter()` has run.
+    await writeFile(join(dir, '1.page.md'), [
+      '---',
+      'title: Page',
+      'innerHTML: "<b>x</b>"',
+      'navigation.onclick: "x()"',
+      'links:',
+      '  - label: Docs',
+      '    to: "javascript:void(0)"',
+      '---',
+      '',
+      '# Page',
+      ''
+    ].join('\n'))
+
+    const content = createBuildInstance('docs:5.x', { source: fs(dir, { prefix: '/docs/5.x' }) })
+    const page = await content.get('/docs/5.x/page')
+
+    expect(page?.data).toEqual({ title: 'Page', navigation: {}, links: [{ label: 'Docs' }] })
+    await content.dispose()
+  })
+
+  it('sanitizes YAML files, which never go through comark', async () => {
+    dir = await mkdtemp(join(tmpdir(), 'nuxt-sanitize-'))
+    await writeFile(join(dir, 'index.yml'), [
+      'title: Home',
+      'hero:',
+      '  links:',
+      '    - label: Docs',
+      '      to: "javascript:void(0)"',
+      '      "^onclick": "x()"',
+      '  as: script',
+      ''
+    ].join('\n'))
+
+    const content = createBuildInstance('site', { source: fs(dir, { prefix: '/' }) })
+    const page = await content.get('/')
+
+    expect(page?.data).toEqual({ title: 'Home', hero: { links: [{ label: 'Docs' }] } })
+    await content.dispose()
+  })
+})
diff --git a/utils/factory.ts b/utils/factory.ts
index a14a749fa..bc7b43c96 100644
--- a/utils/factory.ts
+++ b/utils/factory.ts
@@ -7,7 +7,7 @@ import yaml from 'comark-content/plugins/yaml'
 import json from 'comark-content/plugins/json'
 import tracingOtel from 'comark-content/plugins/tracing/otel'
 import type { Tracer } from '@opentelemetry/api'
-import { comarkPlugins, instancePlugins } from '../server/utils/content/plugins'
+import { comarkPlugins, instancePlugins, sanitizePlugin } from '../server/utils/content/plugins'
 import { instanceSource, type InstanceSource } from '../server/utils/content/instances'
 import { instanceBasePath, type ContentInstanceKey } from '../shared/utils/content'
 import { contentTracer } from '../server/utils/tracer'
@@ -73,6 +73,7 @@ function create(key: ContentInstanceKey, options: InstanceOptions, tracer?: Trac
       yaml({ listingFields: definition.listingFields }),
       json({ listingFields: definition.listingFields }),
       ...instancePlugins(key),
+      sanitizePlugin,
       tracer && tracingOtel({ tracer })
     ],
     cache: options.cache