CVE-2025-59717: @digitalocean/do-markdownit has Type Confusion vulnerability

The vulnerability exists in the @digitalocean/do-markdownit library and is a classic case of Type Confusion. The root cause lies in two plugins, callout and fence_environment, which are intended to filter user-provided classes and environments against an allowlist. The plugins expect the allowedClasses and allowedEnvironments options to be arrays of strings. When these options are misconfigured as a single comma-separated string, the JavaScript includes() method is called on a string object instead of an array object. For strings, includes() performs a substring search, while for arrays, it checks for the presence of an element. This discrepancy allows an attacker to bypass the intended security control. For example, if allowedClasses is the string "admin,info", an attacker can use the class "in" which is a substring of "admin,info", and the check will pass, granting unauthorized access or styling. The analysis of the proof-of-concept and the source code of rules/embeds/callout.js and modifiers/fence_environment.js confirms this behavior. The vulnerable functions are the internal calloutRule and render functions where these checks are performed.