Remote Code Execution Vulnerability in Mintlify Platform

CVE-2025-67846

What is CVE-2025-67846?

The Deployment Infrastructure in the Mintlify Platform prior to November 15, 2025, is susceptible to remote code execution attacks. Attackers can bypass security patches implemented in the application and exploit predictable deployment identifiers on the Vercel preview domain. By discerning the URL structure of unpatched previous deployments, attackers can effectively conduct downgrade attacks, forcing the application to revert to and execute vulnerable versions by directly accessing specific git-ref or deployment-id subdomains.

References