CVE-2025-66400: mdast-util-to-hast unsanitized class attribute
Impact
Multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. The following markdown:
markdown js xss
Would create <pre><code class="language-js xss"></code></pre> If your page then applied .xss classes (or listeners in JS), those apply to this element. For more info see <https://github.com/ChALkeR/notes/blob/master/Improper-markup-sanitization.md#unsanitized-class-attribute>
Patches
The bug was patched. When using regular semver, run npm install. For exact ranges, make sure to use 13.2.1.
Workarounds
Update.
References
bug introduced in https://github.com/syntax-tree/mdast-util-to-hast/commit/6fc783ae6abdeb798fd5a68e7f3f21411dde7403 bug fixed in https://github.com/syntax-tree/mdast-util-to-hast/commit/ab3a79570a1afbfa7efef5d4a0cd9b5caafbc5d7
Other sources
mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This vulnerability is fixed in 13.2.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66400?
CVE-2025-66400 has a high severity due to the potential for untrusted user content to be manipulated.
How do I fix CVE-2025-66400?
To fix CVE-2025-66400, update mdast-util-to-hast to version 13.2.1 or later.
What versions are affected by CVE-2025-66400?
CVE-2025-66400 affects mdast-util-to-hast from version 13.0.0 to before 13.2.1.
What kind of attack does CVE-2025-66400 vulnerability enable?
CVE-2025-66400 enables user-supplied markdown code to be rendered using unprefixed classnames, which may lead to CSS styling conflicts.
Is user input affected by CVE-2025-66400?
Yes, CVE-2025-66400 specifically impacts user input processed through the mdast-util-to-hast module.