CVE-2025-67842

MEDIUM 5.4CVE-2025-67842 · Published 19/12/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
mintlify mintlify	`< 2025-11-15`	`2025-11-15`

Description

The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.

References

gist.github.com/hackermondev/5e2cdc32849405fff6b46957747a2d28 · Third Party Advisory
heartbreak.ing · Third Party Advisory
kibty.town/blog/mintlify · Exploit
news.ycombinator.com/item · Issue Tracking
mintlify.com/blog/working-with-security-researchers-november-2025 · Vendor Advisory
mintlify.com/docs/changelog · Release Notes

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free