CVE-2025-67842

Katalog CVE

CVSS 5.4 · Medium EPSS 0,36%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada mintlify. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.

Rincian

Terbit di NVD

19 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mintlify.com/blog/working-with-security-researchers-november-2025 advisory vendor
• https://gist.github.com/hackermondev/5e2cdc32849405fff6b46957747a2d28 advisory pihak ketiga
• https://heartbreak.ing advisory pihak ketiga
• https://kibty.town/blog/mintlify/ exploit · advisory pihak ketiga
• https://news.ycombinator.com/item?id=46317098 issue tracking
• https://www.mintlify.com/docs/changelog release notes