CVE-2025-67842

medium

Description

The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.

References

Advisories
More

https://heartbreak.ing

https://gist.github.com/hackermondev/5e2cdc32849405fff6b46957747a2d28

https://kibty.town/blog/mintlify/

https://www.mintlify.com/docs/changelog

https://www.mintlify.com/blog/working-with-security-researchers-november-2025

https://news.ycombinator.com/item?id=46317098

Details

Source: Mitre, NVD

Published: 2025-12-19

Updated: 2026-01-02

Risk Information

CVSS v2

Base Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 5.4

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N