CVE-2025-67842

5.4 mediumEPSS 0.4%

Medium (5.4) in mintlify mintlify. EPSS 0.4% chance of exploitation in the next 30 days.

The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
CWE: CWE-829
Published: 2025-12-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mintlify:mintlify

References

https://gist.github.com/hackermondev/5e2cdc32849405fff6b46957747a2d28
https://heartbreak.ing
https://kibty.town/blog/mintlify/
https://news.ycombinator.com/item?id=46317098
https://www.mintlify.com/blog/working-with-security-researchers-november-2025

Check your stack JSON