PT-2025-52404 · Mintlify · Mintlify Platform

Dan + 2 · Published 2025-12-18 · Updated 2025-12-24 · CVE-2025-67843

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mintlify Platform versions prior to 2025-11-15

Description A Server-Side Template Injection (SSTI) flaw exists in the MDX Rendering Engine of Mintlify Platform. This issue allows remote attackers to execute arbitrary code through inline JSX expressions within an MDX file. The vulnerability is related to the processing of MDX files and the rendering of JSX expressions. SSTI occurs when user-supplied input is incorporated into a server-side template without proper sanitization, allowing an attacker to inject malicious code that is then executed by the server.

Recommendations Update Mintlify Platform to a version released on or after 2025-11-15.

Exploit

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2025-67843

Affected Products

Mintlify Platform

References · 12

• 🔥 https://kibty.town/blog/mintlify · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67843 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67843 · Vendor Advisory
• https://mintlify.com/blog/working-with-security-researchers-november-2025 · Vendor Advisory
• https://t.me/cveNotify/146289 · Telegram Post
• https://mintlify.com/docs/changelog · Note
• https://news.ycombinator.com/item?id=46317098 · Note
• https://twitter.com/VulmonFeeds/status/2001861869661741462 · Twitter Post
• https://t.me/CVEtracker/40214 · Telegram Post
• https://twitter.com/cracbot/status/2003782756560670821 · Twitter Post
• https://twitter.com/CVEnew/status/2002099216064393528 · Twitter Post
• https://twitter.com/MDLcsgo/status/2001729741632491872 · Twitter Post