Mintlify is a documentation platform and publishing tool that exposes a vulnerability surface centered on access control and template/parameter handling, with recurring weaknesses including direct request abuse, improper template neutralization, path traversal, and insufficient validation of external control over web parameters. The observed weakness classes reflect risks inherent to dynamic content generation and insufficient input sanitization in web-facing documentation and publishing workflows; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Mintlify over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-67843CRITICAL A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inlin | Dec 19, 2025 | 9.8 | 32 | NO | NO |
CVE-2025-67846MEDIUM The Deployment Infrastructure in Mintlify Platform before 2025-11-15 allows remote attackers to bypass security patches and execute downgrade attacks via predictable deployment ide | Dec 19, 2025 | 6.5 | 22 | NO | NO |
CVE-2025-67845MEDIUM A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via a c | Dec 19, 2025 | 5.4 | 20 | NO | NO |
CVE-2025-67842MEDIUM The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets c | Dec 19, 2025 | 5.4 | 20 | NO | NO |
CVE-2025-67844MEDIUM The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and name fields. It fails | Dec 19, 2025 | 4.3 | 18 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Mintlify.
Media articles that mention a CVE ID that affects a product developed by Mintlify — matched by CVE ID, not by vendor name.