CVE-2025-67843

Critical · 9.8

CVSS

9.8

EPSS

1.1%

Published

Dec 19, 2025

CISA due date

—

The record

A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file.

Affected packages

Ecosystem	Package	Introduced	Fixed