Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

mdast-util-to-hast

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9npmAmendedPublished

    mdast-util-to-hast has unsanitized class attribute

    CVE-2025-66400 · GHSA-4fh9-h7wg-q85m

    Affected
    • npm mdast-util-to-hast >= 13.0.0, < 13.2.1
    Fixed in
    13.2.1· Vendor fix available
    Issue
    Impact Multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. The following markdown: js&#x20;xss Would create <pre<code class="language-js xss"</code</pre If your page then applied .xss classes (or listeners in JS), those apply to this element. For more info see <https://github.com/ChALkeR/notes/blob/master/Improper-markup-sanitization.md#unsanitized-class-attribute Patches The bug was patched. When using regular semver, run npm install. For exact ranges, make sure to use 13.2.1. Workarounds Update. References bug introduced in https://github.com/syntax-tree/mdast-util-to-hast/commit/6fc783ae6abdeb798fd5a68e7f3f21411dde7403 bug fixed in https://github.com/syntax-tree/mdast-util-to-hast/commit/ab3a79570a1afbfa7efef5d4a0cd9b5caafbc5d7

    Recommended action: Upgrade to 13.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →