{"id":"CVE-2025-66400","revision":"b9dae875cbb4448b8218c697ec1d2071","records":[{"revision":"b9dae875cbb4448b8218c697ec1d2071","observedAt":"2026-10-25T03:17:36.152+00:00","statement":{"source":"nvd","id":"CVE-2025-66400","aliases":[],"title":"mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown cod…","description":"mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This vulnerability is fixed in 13.2.1.","state":0,"publishedAt":"2025-12-01T23:15:53.07+00:00","modifiedAt":"2026-10-18T18:10:00.1+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/syntax-tree/mdast-util-to-hast/commit/6fc783ae6abdeb798fd5a68e7f3f21411dde7403","https://github.com/syntax-tree/mdast-util-to-hast/commit/ab3a79570a1afbfa7efef5d4a0cd9b5caafbc5d7","https://github.com/syntax-tree/mdast-util-to-hast/security/advisories/GHSA-4fh9-h7wg-q85m"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66400","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-20","CWE-915","NVD-CWE-Other"],"productCriteria":["cpe:2.3:a:unifiedjs:mdast-util-to-hast:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2025-12-01T23:15:53.070","lastModified":"2026-10-18T18:10:00.100"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-66400","identifiers":["CVE-2025-66400"]},"retained":false,"historicalAffected":[]}],"coverage":[]}