CVE-2025-67842 Overview
CVE-2025-67842 is a cross-site scripting (XSS) vulnerability in the Mintlify Platform Static Asset API. The flaw permits remote attackers to inject arbitrary web script or HTML through the subdomain parameter. The root cause is a tenant isolation failure: any tenant's uploaded assets can be served from any other tenant's documentation site. An attacker who controls one Mintlify tenant can host malicious HTML or JavaScript and cause it to load under a victim tenant's origin. The issue is tracked as [CWE-829: Inclusion of Functionality from Untrusted Control Sphere] and was addressed in the Mintlify Platform on 2025-11-15.
Critical Impact
Attackers can execute arbitrary script in the browser context of any Mintlify-hosted documentation site, enabling session theft, credential harvesting, and content defacement across tenants.
Affected Products
- Mintlify Platform versions released before 2025-11-15
- Documentation sites hosted on the shared Mintlify multi-tenant infrastructure
- Any Mintlify tenant using the Static Asset API for image or file delivery
Discovery Timeline
- 2025-12-19 - CVE-2025-67842 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-67842
Vulnerability Analysis
The Mintlify Platform serves customer documentation from tenant-specific subdomains. The Static Asset API resolves uploaded content, such as images, scripts, and HTML fragments, using a subdomain parameter supplied at request time. The API does not enforce that the requested asset belongs to the tenant matching the origin serving the response.
As a result, an attacker who registers a Mintlify tenant can upload arbitrary content, including HTML documents containing JavaScript payloads. When a victim tenant's documentation site is loaded, the malicious asset can be referenced and returned from the same origin as the victim site. Browsers execute the injected script under the victim's origin, defeating the same-origin policy that would otherwise contain the attacker's content.
The issue is categorized as reflected or stored XSS through cross-tenant asset inclusion. The scope change reflected in the CVSS vector indicates that impact extends beyond the vulnerable component to end users of unrelated tenants.
Root Cause
The Static Asset API accepts a caller-controlled subdomain value and uses it to locate assets without validating that the resolved asset belongs to the tenant whose documentation is currently being rendered. This missing authorization check on cross-tenant asset resolution maps to [CWE-829] because untrusted tenant-controlled functionality is included in another tenant's control sphere.
Attack Vector
Exploitation requires the attacker to hold a low-privilege Mintlify account and to induce a victim user to visit a crafted URL on the target documentation site. The attacker uploads a malicious HTML or JavaScript asset to their own tenant, then constructs a link to the victim tenant's site that causes the Static Asset API to serve the attacker-controlled file. Successful exploitation yields script execution in the victim origin, enabling cookie theft, phishing overlays, and manipulation of documentation content.
A public proof-of-concept and technical write-ups are referenced in the GitHub PoC Gist, the Kibty Blog on Mintlify, and the Mintlify Blog on Security Researchers.
Detection Methods for CVE-2025-67842
Indicators of Compromise
- Requests to the Mintlify Static Asset API where the subdomain parameter does not match the host serving the documentation page.
- Unexpected HTML or JavaScript MIME responses from asset paths that normally return images or static media.
- Outbound browser requests from documentation domains to attacker-controlled collection endpoints following asset loads.
Detection Strategies
- Review web server and CDN access logs for anomalous subdomain parameter values referencing tenants unrelated to the requested host.
- Correlate documentation session cookies exfiltrated to external domains with prior asset requests handled by the Static Asset API.
- Deploy a Content Security Policy (CSP) report-only header on hosted documentation to surface unexpected inline script or cross-origin script sources.
Monitoring Recommendations
- Alert on Static Asset API responses that return text/html or application/javascript content types when image or media types are expected.
- Monitor tenant-scoped asset uploads for HTML, SVG with embedded scripts, or JavaScript files uploaded by newly registered accounts.
- Track user reports of unexpected redirects, authentication prompts, or defaced content on documentation sites.
How to Mitigate CVE-2025-67842
Immediate Actions Required
- Confirm your Mintlify tenant is running platform code released on or after 2025-11-15, as the fix is applied at the platform level.
- Rotate any API tokens, session cookies, or secrets that may have been exposed through documentation sites before the patch date.
- Audit uploaded assets across your tenant for unexpected HTML or JavaScript files and remove any that are not required.
Patch Information
Mintlify remediated the vulnerability in the platform on 2025-11-15 by enforcing tenant isolation in the Static Asset API. Because Mintlify is a hosted service, no customer-side upgrade is required. Refer to the Mintlify Blog on Security Researchers and the Mintlify Documentation Changelog for the fix announcement.
Workarounds
- Apply a strict Content Security Policy on custom documentation domains to restrict script sources to trusted origins.
- Disable or restrict tenant-supplied HTML and SVG asset uploads where the workflow does not require them.
- Require authenticated access to sensitive documentation to reduce the population of users exposed to cross-tenant asset delivery.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
