CVE-2025-59717: vulnerability facts

CVE-2025-59717

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string (instead of an array).

CVSS 5.4 · Medium · EPSS 0.4%

Published: 2025-09-19T00:00:00.000Z
Updated: 2025-09-19T13:32:08.575Z

Stack: node

Affected products and versions

@digitalocean/do-markdownit
Versions
- ≥ 0, ≤ 1.16.1: Affected (semver)
No fix published
@digitalocean/do-markdownit npm
Affected ranges
- SEMVER: ≤ 1.16.1
No fix published

Original sources

https://github.com/digitalocean/do-markdownit
https://gist.github.com/thesmartshadow/dd19665f1f51a4e3c7a766e70c9eafd0
https://www.npmjs.com/package/@digitalocean/do-markdownit
https://nvd.nist.gov/vuln/detail/CVE-2025-59717

Check your server →

CVE-2025-59717

Affected products and versions

@digitalocean/do-markdownit

@digitalocean/do-markdownit npm

Original sources