CVE-2025-66400: syntax-tree mdast-util-to-hast Improper Input Validation
CVSS: 6.9v4.0MediumAnalyzed
AliasesCGA-32vx-m24g-ccchCGA-3q58-9hwp-5jpfCGA-4579-vqpr-rhprCGA-593h-xrrp-crq5CGA-6rm5-c78m-825pCGA-8fr2-5r72-j2j5CGA-8jhg-j76w-g6jwCGA-j8cp-2833-254wCGA-jfhv-w3g5-fxxfCGA-m566-hvp5-m4m7GHSA-4fh9-h7wg-q85mCGA-2pqj-2q5g-34m3CGA-3gq2-jcmj-2954CGA-3mqm-94jj-c7f9CGA-4ffq-wpg4-58rcCGA-5337-5fg9-q72vCGA-5jqr-427r-wxfgCGA-66w7-5x56-p3g2CGA-6xgr-4chp-cr2hCGA-7g6c-f592-qr2rCGA-f74c-72v8-w96vCGA-fg7w-3635-5vqcCGA-gf48-6pv4-c57jCGA-jp32-prr9-f2vfCGA-jp97-9x4j-72hjCGA-jqhc-9859-xvx5CGA-m3jv-h2cm-f8w5CGA-mw2m-3hjm-mqphCGA-vv86-c394-cxg9CGA-w6hh-338w-hrcmCGA-wgrp-chfh-mh4jCGA-xmwv-2589-jr5j
Published 01-12-2025Last modified 02-12-2025
Vulnerability summary
CVE-2025-66400 is a medium (CVSS 6.9) Improper Input Validation vulnerability in syntax-tree mdast-util-to-hast. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.8% of scored vulnerabilities.
CVSS score
6.9/10
010
Medium · v4.0 (CVE.org)EPSS score
0.30%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 01-12-2025PublishedVulnerability first disclosed.
- 02-12-2025Last modifiedVulnerability information updated.
Description
mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This vulnerability is fixed in 13.2.1.
CVSS metrics
7 scores · 5 sources · 2 versionsMedium 6.9Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- OSV · NpmEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.3Preferred score · OSV · Npm (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NSourcesAll 2 agree
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
0.00 pp
From 0.30% on 20-09-2026
20-09-202620-10-2026
EPSS score0.30%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-915Improperly Controlled Modification of Dynamically-Determined Object AttributesThe product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Affected systems
Chainguard15 products
- drupal-11.3< 11.3.13-r3
- keycloak-26.6< 26.6.4-r17
- keycloak-26.6-iamguarded-compat< 26.6.4-r17
- langfuse-2< 2.95.12-r2
- langfuse-2-compat< 2.95.12-r2
Wolfi5 products
- keycloak-26.6< 26.6.4-r17
- keycloak-26.6-iamguarded-compat< 26.6.4-r17
- langfuse-3< 3.137.0-r1
- langfuse-3-compat< 3.137.0-r1
- langfuse-3-worker< 3.137.0-r1
Npm1 product
- mdast-util-to-hast≥ 13.0.0, < 13.2.1
Syntax-tree1 product
- mdast-util-to-hast≥ 13.0.0, < 13.2.1
Unifiedjs1 product
- mdast-util-to-hast≥ 13.0.0, < 13.2.1
5 vendors · 23 products
References
6 links- github.com/syntax-tree/mdast-util-to-hast/security/advisories/GHSA-4fh9-h7wg-q85mX Refsource CONFIRMAdvisoryWEBVendor Advisory
- github.com/syntax-tree/mdast-util-to-hast/commit/6fc783ae6abdeb798fd5a68e7f3f21411dde7403X Refsource MISCFIXWEBPatch
- github.com/syntax-tree/mdast-util-to-hast/commit/ab3a79570a1afbfa7efef5d4a0cd9b5caafbc5d7X Refsource MISCFIXWEBPatch
