GHSA-4fh9-h7wg-q85m
Medium · 5.3CVSS
5.3
EPSS
—
Published
Dec 2, 2025
CISA due date
—
The record
mdast-util-to-hast has unsanitized class attribute
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | mdast-util-to-hast | 13.0.0 | 13.2.1 |
| Chainguard | langfuse-2 | 0 | 2.95.12-r2 |
| Chainguard | langfuse-2-compat | 0 | 2.95.12-r2 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r2 |
| Chainguard | langfuse-3 | 0 | 3.137.0-r1 |
| Chainguard | langfuse-3-compat | 0 | 3.137.0-r1 |
| Chainguard | langfuse-3-worker | 0 | 3.137.0-r1 |
| Chainguard | langfuse-fips-2 | 0 | 2.95.12-r1 |
| Chainguard | langfuse-fips-2-compat | 0 | 2.95.12-r1 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r1 |
| Chainguard | langfuse-web-3 | 0 | 3.137.0-r1 |
| Chainguard | langfuse-web-compat | 0 | 3.137.0-r1 |
| Chainguard | langfuse-worker-3 | 0 | 3.137.0-r1 |
| Chainguard | librechat | 0 | 0.8.0-r6 |
| Chainguard | librechat-compat | 0 | 0.8.0-r6 |
| Chainguard | librechat-dev | 0 | 0.8.0-r6 |
| Wolfi | langfuse-3 | 0 | 3.137.0-r1 |
| Wolfi | langfuse-3-compat | 0 | 3.137.0-r1 |
| Wolfi | langfuse-3-worker | 0 | 3.137.0-r1 |
| Wolfi | langfuse-web-3 | 0 | 3.137.0-r1 |
| Wolfi | langfuse-web-compat | 0 | 3.137.0-r1 |
| Wolfi | langfuse-worker-3 | 0 | 3.137.0-r1 |
Related vulnerabilities
- CVE-2025-66400 mdast-util-to-hast is an mdast utility to transform to hast. Same vulnerability
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects langfuse-2
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects langfuse-2
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects langfuse-2
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects langfuse-2
- GHSA-37ch-88jc-xwx2 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route… Also affects langfuse-2
- CVE-2026-33671 Picomatch is a glob matcher written JavaScript. Also affects langfuse-2
- CVE-2026-33672 Picomatch is a glob matcher written JavaScript. Also affects langfuse-2