CVE-2025-67842

MEDIUM6.4

The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site

Published Dec 19, 2025

Modified 3 weeks ago

No fix available

Details

The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.

References

WEBhttps://gist.github.com/hackermondev/5e2cdc32849405fff6b46957747a2d28 WEBhttps://heartbreak.ing DETECTIONhttps://kibty.town/blog/mintlify/WEBhttps://news.ycombinator.com/item?id=46317098 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-67842 WEBhttps://www.mintlify.com/blog/working-with-security-researchers-november-2025 WEBhttps://www.mintlify.com/docs/changelog

CVSS Analysis

CVSS v3.1

6.4

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

ChangedS:C

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

NoneA:N

6.4/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness Type (CWE)

Trust

CWE-829

Untrusted Control Sphere

Ecosystems

Timeline

PublishedDec 19, 2025

ModifiedDec 23, 2025