Improper Input Sanitization

mdast-util-to-hast is vulnerable to Improper Input Sanitization. The vulnerability is due to the utility allowing multiple unprefixed classnames to be injected via character references in markdown, which allows an attacker to disguise malicious code elements so they appear as trusted parts of the...

EUVD-2025-200113

mdast-util-to-hast has unsanitized class attribute...

mdast-util-to-hast has unsanitized class attribute

Impact Multiple unprefixed classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. The following markdown: markdown jsxss Would create If your page then applied .xss classes or...

@adobe/helix-docx2md (>=1.4.16, <=1.9.7), @adobe/helix-html-pipeline (>=4.1.6, <=6.27.14) +37 more potentially affected by CVE-2025-66400 via mdast-util-to-hast (>=13.0.0, <=13.2.0)

mdast-util-to-hast NPM version =13.0.0, =1.4.16, =4.1.6, =1.0.0, =2.9.31, =7.0.0, =2.1.26, =1.0.0, =3.0.0, =2.0.0, =1.1.1, =1.0.0, =1.0.0-B001, =1.0.277, =0.40.5, =0.38.0, =2.9.0 and more Source cves: CVE-2025-66400 Source advisory: OSV:GHSA-4FH9-H7WG-Q85M...

GHSA-4FH9-H7WG-Q85M mdast-util-to-hast has unsanitized class attribute

Impact Multiple unprefixed classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. The following markdown: markdown jsxss Would create If your page then applied .xss classes or...

CVE-2025-66400

mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple unprefixed classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This...

@adobe/helix-docx2md (>=1.4.16, <=1.9.7), @adobe/helix-html-pipeline (>=4.1.6, <=6.27.14) +37 more potentially affected by CVE-2025-66400 via mdast-util-to-hast (>=13.0.0, <=13.2.0)

mdast-util-to-hast NPM version =13.0.0, =1.4.16, =4.1.6, =1.0.0, =2.9.31, =7.0.0, =2.1.26, =1.0.0, =3.0.0, =2.0.0, =1.1.1, =1.0.0, =1.0.0-B001, =1.0.277, =0.40.5, =0.38.0, =2.9.0 and more Source cves: CVE-2025-66400 Source advisory: SNYK:JS-MDASTUTILTOHAST-14157221...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview mdast-util-to-hast is a mdast utility to transform to hast Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the class attribute in rendered markdown code elements. An attacker can cause arbitrary CSS...

CVE-2025-66400 mdast-util-to-hast unsanitized class attribute

mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple unprefixed classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This...

CVE-2025-66400 mdast-util-to-hast unsanitized class attribute

mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple unprefixed classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This...

CVE-2025-66400

Summary: mdast-util-to-hast (an MD to HAST utility) is affected from versions 13.0.0 up to before 13.2.1. The issue arises when using character references to inject unprefixed classnames in Markdown sources, which can cause rendered user-supplied code elements to appear as part of the page. The p...

PT-2025-48573

Name of the Vulnerable Software and Affected Versions mdast-util-to-hast versions 13.0.0 through 13.2.0 Description mdast-util-to-hast, a utility used to transform markdown to HTML, has an issue where multiple, unprefixed classnames could be added to markdown source using character references. Th...