CVE-2025-67842: Medium severity Mintlify Mintlify Platform vulnerability
The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67842?
CVE-2025-67842 is classified as a high-severity vulnerability due to the potential for remote code execution via script injection.
How does CVE-2025-67842 affect the Mintlify Platform?
CVE-2025-67842 allows remote attackers to inject arbitrary web scripts or HTML through the subdomain parameter, compromising tenant asset security.
What are the potential impacts of CVE-2025-67842?
Exploitation of CVE-2025-67842 could lead to unauthorized data access, user impersonation, or other malicious activities on affected documentation sites.
How do I fix CVE-2025-67842?
To fix CVE-2025-67842, upgrade the Mintlify Platform to a version released after November 15, 2025.
Who is affected by CVE-2025-67842?
All users of the Mintlify Platform prior to the fix on November 15, 2025, are potentially affected by CVE-2025-67842.