CVE-2025-67843: High MDX Template Injection in Mintlify

CVE-2025-67843 is a high severity (CVSS 8.3) server side template injection in the MDX rendering engine of Mintlify Platform before 2025-11-15. Inline JSX expressions could run code on the server. It is a hosted service, so the platform fix is the vendor job.

What's affected

Mintlify Platform before 2025-11-15, per the record. Mintlify is a hosted documentation service, so customers do not install the affected code. The fix lives on the vendor side, and the record gives a date, not a package version.

A researcher write-up listed in the record describes the finding and attributes this CVE to it. Mintlify's own post about security events in November 2025 describes a separate issue, cross domain XSS in static asset hosting, and explains which customers were potentially affected by it. As far as I could confirm from the pages I fetched, that post covers a different issue than this CVE, so do not read its scope as this CVE's scope.

I did not find a fixed version or CVSS score from the vendor beyond the record.

How to check if you're exposed

For a hosted service, your checks are about your own content and surrounding setup.

Review who can publish MDX to your Mintlify project, and review your repository history for pages added in the weeks around the platform fix. If you host documentation on the same domain as an authenticated app, read the vendor's guidance on which setups carry more risk, such as cookies scoped to a wide domain.

If you render MDX yourself, search for code paths that compile or evaluate content from untrusted contributors:

grep -rn "evaluate\|compileMDX\|@mdx-js" --include=*.ts --include=*.js --include=*.tsx .

What to do now

1. Confirm with your Mintlify account contact that the platform fix after 2025-11-15 applies to your project.
2. Restrict who can commit or upload MDX to your documentation repository.
3. Prefer a separate domain for documentation, with cookies scoped to the app domain only.
4. Rotate credentials that were stored in places a documentation host could reach, if you have any doubt.
5. If you render MDX yourself, disable expression evaluation for content from untrusted authors.

Why it matters

MDX combines Markdown with JSX, which means a page can contain JavaScript expressions. If a server compiles and evaluates that content, then whoever writes the page controls code on the server. That is a server side template injection, filed as CWE-1336.

The broader lesson is for anyone who builds a multi tenant platform: user supplied templates must run in a restricted environment, never in the same process and permission set that holds platform secrets. Customers of such platforms should ask vendors how tenant content is isolated. The record does not list this CVE as known exploited.

Quick check

Sources

• Safeguard Gold page for CVE-2025-67843
• Mintlify security event post, November 2025
• Researcher write-up listed in the record

Last reviewed: 18 October 2026.