Description
The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mintlify | Mintlify Platform | < 2025-11-15 | 2025-11-15 |