CVE-2025-66400mediumCWE-20CWE-915

CVE-2025-66400: fallo de gravedad media en syntax-tree mdast-util-to-hast

mdast-util-to-hast unsanitized class attribute

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear mdast-util-to-hast+ Monitorear mdast-util-to-hast

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.9epss 0.3%
mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This vulnerability is fixed in 13.2.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
syntax-tree · mdast-util-to-hast