CVE-2025-67843

Published: Dec 19, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file.

Affected (1)

Products: Mintlify: Mintlify

Mintlify

1 product

Mintlify

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mintlify Mintlify	Before 2025-11-15

Related CWEs

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

References (5)

https://kibty.town/blog/mintlify/

Source: cve@mitre.org

ExploitThird Party Advisory

https://news.ycombinator.com/item?id=46317098

Source: cve@mitre.org

Issue Tracking

https://www.mintlify.com/blog/working-with-security-researchers-november-2025

Source: cve@mitre.org

Vendor Advisory

https://www.mintlify.com/docs/changelog

Source: cve@mitre.org

Release Notes

https://kibty.town/blog/mintlify/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.