CVE-2025-59717 — MEDIUM (5.4)

Q: How severe is CVE-2025-59717?

CVE-2025-59717 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2025-59717?

Check the references section above for vendor advisories and patch information. Affected products include: Digitalocean Do-Markdownit.

Vulnerability Description

In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string (instead of an array).

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Digitalocean	Do-Markdownit	<= 1.16.1

Related Weaknesses (CWE)

CWE-843

References

https://gist.github.com/thesmartshadow/dd19665f1f51a4e3c7a766e70c9eafd0ExploitThird Party Advisory
https://github.com/digitalocean/do-markdownitProduct
https://www.npmjs.com/package/@digitalocean/do-markdownitProduct
https://gist.github.com/thesmartshadow/dd19665f1f51a4e3c7a766e70c9eafd0ExploitThird Party Advisory

FAQ

What is CVE-2025-59717?

CVE-2025-59717 is a vulnerability with a CVSS score of 5.4 (MEDIUM). In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string ...

How severe is CVE-2025-59717?

CVE-2025-59717 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-59717?

Check the references section above for vendor advisories and patch information. Affected products include: Digitalocean Do-Markdownit.