CVE-2025-67842
📋 TL;DR
This vulnerability allows remote attackers to inject malicious scripts or HTML into any tenant's documentation site by manipulating the subdomain parameter in Mintlify Platform's Static Asset API. It affects all Mintlify Platform tenants using versions before 2025-11-15, enabling cross-tenant content injection attacks.
💻 Affected Systems
- Mintlify Platform
📦 What is this software?
Mintlify by Mintlify
⚠️ Risk & Real-World Impact
Worst Case
Attackers could inject malicious JavaScript that steals user credentials, session tokens, or redirects users to phishing sites across all tenant documentation sites.
Likely Case
Attackers inject tracking scripts, deface documentation sites, or perform limited cross-site scripting attacks against users.
If Mitigated
With proper input validation and tenant isolation, the attack surface is limited to content injection without direct server compromise.
🎯 Exploit Status
The vulnerability is well-documented with public proof-of-concept examples showing how to manipulate subdomain parameters to inject content across tenant boundaries.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions from 2025-11-15 onward
Vendor Advisory: https://www.mintlify.com/blog/working-with-security-researchers-november-2025
Restart Required: No
Instructions:
1. Upgrade Mintlify Platform to version dated 2025-11-15 or later. 2. Verify the Static Asset API now properly validates and restricts subdomain parameters to tenant boundaries. 3. No restart required as this is a SaaS platform update.
🔧 Temporary Workarounds
Disable Static Asset API
allTemporarily disable the Static Asset API feature until patching is complete
Implement WAF Rules
allAdd web application firewall rules to block suspicious subdomain parameter patterns
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to limit script execution
- Monitor for unusual subdomain parameter patterns in access logs
🔍 How to Verify
Check if Vulnerable:
Test if you can access another tenant's static assets by modifying the subdomain parameter in API requestsCheck Version:
Check your Mintlify Platform dashboard or API for version information - should show 2025-11-15 or laterVerify Fix Applied:
Verify that subdomain parameters are now properly validated and restricted to the authenticated tenant's assets only📡 Detection & Monitoring
Log Indicators:
- Unusual subdomain parameter values in Static Asset API requests
- Requests attempting to access assets from multiple tenant IDs
Network Indicators:
- HTTP requests with manipulated subdomain parameters
- Unexpected cross-origin resource sharing patterns
SIEM Query:
source="mintlify_logs" AND (uri_path="/api/static-assets" OR uri_path="/api/assets") AND (subdomain_parameter CONTAINS suspicious_pattern OR subdomain_parameter != expected_tenant_id)🔗 References
- https://gist.github.com/hackermondev/5e2cdc32849405fff6b46957747a2d28
- https://heartbreak.ing
- https://kibty.town/blog/mintlify/
- https://news.ycombinator.com/item?id=46317098
- https://www.mintlify.com/blog/working-with-security-researchers-november-2025
- https://www.mintlify.com/docs/changelog
- https://kibty.town/blog/mintlify/
