CVE-2025-66400: Beware! Markdown Styling Hijack in mdast-util-to-hast

Overview

CVE-2025-66400 is a security vulnerability affecting the mdast-util-to-hast library, a utility used for transforming Markdown Abstract Syntax Trees (mdast) to Hypertext Abstract Syntax Trees (hast). Versions 13.0.0 through 13.2.0 are vulnerable. This vulnerability allows attackers to inject arbitrary class names into the rendered HTML by using character references within the Markdown source. This, in turn, could allow malicious users to style rendered markdown, particularly code elements, to blend in with the rest of the page, potentially leading to phishing or other deceptive attacks.

Technical Details

The vulnerability stems from improper sanitization of character references when converting Markdown to HTML. By carefully crafting Markdown input with specific character references that resolve to HTML class names, an attacker can inject those class names into the resulting <code> elements (or other elements depending on the specific markdown structure). This allows the attacker to control the styling of the rendered content.

The specific commits that address the issue are 6fc783ae6abdeb798fd5a68e7f3f21411dde7403 and ab3a79570a1afbfa7efef5d4a0cd9b5caafbc5d7, which implement proper input validation and escaping to prevent class name injection.

CVSS Analysis

Currently, the CVSS score for CVE-2025-66400 is N/A, indicating that a formal CVSS score has not yet been assigned. However, given the potential for malicious styling and phishing attacks, it’s important to address this vulnerability promptly.

Possible Impact

The primary impact of this vulnerability is the ability to manipulate the styling of rendered Markdown content. This can be leveraged for:

• Phishing Attacks: Malicious users could make code snippets look like legitimate parts of the page, tricking users into entering sensitive information.
• UI Spoofing: Attacker can make elements of rendered markdown look like UI elements of the website that uses it.
• Cross-Site Scripting (XSS): While not directly XSS, the ability to control styling can be a stepping stone to more complex attacks, especially if combined with other vulnerabilities.

Mitigation or Patch Steps

The recommended mitigation is to upgrade to mdast-util-to-hast version 13.2.1 or later. This version contains the necessary fixes to prevent class name injection via character references.

1. Update the dependency: Use your package manager (e.g., npm, yarn, pnpm) to update mdast-util-to-hast to the latest version. For example, using npm: npm install mdast-util-to-hast@latest
2. Verify the fix: After updating, thoroughly test your application to ensure that the vulnerability is resolved and that Markdown rendering is functioning as expected.

References

GitHub Commit: Fix for CVE-2025-66400
GitHub Commit: Additional Fixes
GitHub Security Advisory: GHSA-4fh9-h7wg-q85m