Vulnerabilidades do Mintlify Mintlify
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Mintlify Mintlify: 5 registro(s), com versões afetadas e correções.cpe:2.3:a:mintlify:mintlify
CVE-2025-67846
Média · 6.5
CWE-472 18/12/2025
The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote…
The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass security patches and execute downgrade attacks via predictable deployment identifiers on the Vercel preview domain. An attacker can identify the URL structure of a previous deployment that contains unpatched vulnerabilities. By browsing directly to the specific git-ref or deployment-id subdomain, the attacker can force the application to load the vulnerable version.
CVE-2025-67845
Média · 5.4
CWE-24 18/12/2025
A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify…
A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing path traversal sequences.
CVE-2025-67844
Média · 4.3
CWE-425 18/12/2025
The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote…
The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and name fields. It fails to validate that the repository owner and name fields provided during configuration belong to the specific GitHub App Installation ID associated with the user's organization.
CVE-2025-67843
Crítica · 9.8
CWE-1336 18/12/2025
A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in…
A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file.
CVE-2025-67842
Média · 5.4
CWE-829 18/12/2025
The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to…
The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.