CVE-2025-59717

描述

### Overview A type confusion issue exists in the `@digitalocean/do-markdownit` package. In the `callout` and `fence_environment` plugins, the `allowedClasses` and `allowedEnvironments` options are expected to be arrays of strings. If these options are provided as a single string, the code applies `.includes` directly on the string, resulting in substring matching instead of membership checks against an array. ### Affected Versions All versions up to and including 1.16.1 (npm). ### Impact Supplying crafted input can bypass intended allow-lists (e.g., class/environment constraints) due to substring checks, which may enable rendering of unintended classes or environments and lead to policy bypass in downstream consumers. ### Mitigation Until an upstream fix is released, ensure configuration normalization before invoking the plugins: - Validate that `allowedClasses` and `allowedEnvironments` are arrays (`Array.isArray(...)`), converting single strings into one-element arrays when necessary. - Consider sanitizing or strictly validating user-controlled values that influence Markdown rendering.

如何修補 CVE-2025-59717

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本

CVE-2025-59717 正在被利用嗎?

低 — EPSS 為 0.1%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, <= 1.16.1

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-59717
• PATCHgithub.com/digitalocean/do-markdownit
• WEBgist.github.com/thesmartshadow/dd19665f1f51a4e3c7a766e70c9eafd0
• WEBwww.npmjs.com/package/@digitalocean/do-markdownit