Paper/Archive/CVE-2025-67843

CVE-2025-67843

Mintlify Mintlify Platform — A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote at…

EPSS 1%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 65.9.659 × 2013.2 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file.

Affected

ProductAffectedFixed inSource

Mintlify Platform< 2025-11-152025-11-15CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

mitre (CNA)8.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refmintlify.com/docs/changelog refmintlify.com/blog/working-with-security-researchers-november-2025 exploitkibty.town/blog/mintlify refnews.ycombinator.com/item?id=46317098