Improper input validation in Syntax-Tree Mdast-Util-To-Hast
CVE-2025-66400
mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This vulnerability is fixed in 13.2.1.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.003 (18.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Syntax-tree Mdast-util-to-hast — versions >= 13.0.0, < 13.2.1
- Unifiedjs Mdast-util-to-hast
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-66400?
- CVE-2025-66400 is a medium-severity vulnerability in Syntax-Tree Mdast-Util-To-Hast, classified under Improper Input Validation. CVSS score: 5.3/10. Published 2025-12-01.
- How severe is CVE-2025-66400?
- Medium severity. CVSS v3 base score is 5.3 out of 10.