Vulnerability · Published Dec 19, 2025 · Assigned by mitre
CVE-2025-67842
Medium 6.4
In plain English
A medium-severity security flaw in Mintlify Platform from Mintlify. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.4%top 70.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mintlify | Mintlify Platform | 0 – before 2025-11-15 |
Weakness: CWE-829 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N