CVE-2025-67842CWE-829

The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because…

Medium · published December 19, 2025

CVSS v3.1
6.4
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2025-12-19T00:00Z
EPSS history
Timeline
  • 19 DEC 00:00Z
    The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because…
    cvelistv5