5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59717

CVE-2025-59717: @digitalocean/do-markdownit has Type Confusion vulnerability

In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string (instead of an array).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59717

CVE-2025-59717:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@digitalocean/do-markdownit	npm	<= 1.16.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the @digitalocean/do-markdownit library and is a classic case of Type Confusion. The root cause lies in two plugins, callout and fence_environment, which are intended to filter user-provided classes and environments against an allowlist. The plugins expect the allowedClasses and allowedEnvironments options to be arrays of strings. When these options are misconfigured as a single comma-separated string, the JavaScript includes() method is called on a string object instead of an array object. For strings, includes() performs a substring search, while for arrays, it checks for the presence of an element. This discrepancy allows an attacker to bypass the intended security control. For example, if allowedClasses is the string "admin,info", an attacker can use the class "in" which is a substring of "admin,info", and the check will pass, granting unauthorized access or styling. The analysis of the proof-of-concept and the source code of rules/embeds/callout.js and modifiers/fence_environment.js confirms this behavior. The vulnerable functions are the internal calloutRule and render functions where these checks are performed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.