CVE-2025-67843

CVE-2025-67843 is a Server-Side Template Injection (SSTI) vulnerability, classified under CWE-1336, affecting the MDX Rendering Engine in the Mintlify Platform prior to version 2025-11-15. It enables remote attackers to execute arbitrary code by injecting inline JSX expressions into an MDX file. The vulnerability carries a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), indicating high severity due to its network accessibility, low attack complexity, and potential for high confidentiality and integrity impacts with low availability disruption.

Attackers with low privileges, such as authenticated users on the Mintlify Platform, can exploit this vulnerability remotely without user interaction. By crafting malicious inline JSX expressions within an MDX file, they achieve arbitrary code execution on the server, potentially leading to data breaches, modification of platform content, or limited denial-of-service effects.

Mitigation details are available in vendor advisories, including Mintlify's changelog at https://www.mintlify.com/docs/changelog and their blog post on working with security researchers at https://www.mintlify.com/blog/working-with-security-researchers-november-2025. Security practitioners should ensure deployment of Mintlify Platform version 2025-11-15 or later to address the issue, as earlier versions remain vulnerable. Additional analysis appears in references such as https://kibty.town/blog/mintlify/ and Hacker News discussion at https://news.ycombinator.com/item?id=46317098.