CVE-2025-66400

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66400
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66400.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66400
Aliases
Downstream
Related
Published
2025-12-01T22:17:42Z
Modified
2026-08-12T03:51:13Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
mdast-util-to-hast unsanitized class attribute
Details

mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This vulnerability is fixed in 13.2.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20",
        "CWE-915"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66400.json"
}
References

Affected packages

Git / github.com/syntax-tree/mdast-util-to-hast

Affected ranges

Type
GIT
Repo
https://github.com/syntax-tree/mdast-util-to-hast
Events
Introduced
6e7208513077b5dc553d9a66a7922907318636e3
Fixed
174795b21f7757fffb54dd8d5fb4012f4751f791
Fixed
6fc783ae6abdeb798fd5a68e7f3f21411dde7403
Fixed
ab3a79570a1afbfa7efef5d4a0cd9b5caafbc5d7
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:unifiedjs:mdast-util-to-hast:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "13.0.0"
        },
        {
            "fixed": "13.2.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

13.*
13.0.0
13.0.1
13.0.2
13.1.0
13.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66400.json"