CVE-2025-66400CWE-20CWE-915

CVE-2025-66400

Medium · published December 2, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
22.0
In the wild
Unconfirmed
What it is

mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This vulnerability is fixed in 13.2.1.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00305 · 22.0th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published
2025-12-02T04:15Z
Affected products (1)
ProductVersionsFixed in
unifiedjs/mdast-util-to-hast≥ 13.0.0, < 13.2.113.2.1
References (3)
https://github.com/syntax-tree/mdast-util-to-hast/commit/6fc783ae6abdeb798fd5a68e7f3f21411dde7403 · [email protected]https://github.com/syntax-tree/mdast-util-to-hast/commit/ab3a79570a1afbfa7efef5d4a0cd9b5caafbc5d7 · [email protected]https://github.com/syntax-tree/mdast-util-to-hast/security/advisories/GHSA-4fh9-h7wg-q85m · [email protected]
EPSS history
Timeline
  • 01 DEC 22:17Z
    mdast-util-to-hast unsanitized class attribute
    cvelistv5