CVE-2025-59717: @digitalocean/do markdownit @digitalocean/do-markdownit Has Type Confusion Vulnerability Vulnerability
MODERATECVE-2025-59717 is a MODERATE (CVSS 5.4) @digitalocean/do-markdownit has type confusion vulnerability vulnerability (CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')) affecting @digitalocean/do markdownit libraries in the npm ecosystem. The issue involves @digitalocean/do-markdownit has type confusion vulnerability. Remediation is available in the latest vendor maintenance releases.
CVE-2025-59717 at a Glance
Security Impact
CVSS: 5.4
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N).
How to Fix CVE-2025-59717
To remediate this vulnerability, upgrade all affected @digitalocean/do markdownit dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @digitalocean/do-markdownit@Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @digitalocean/do-markdownitHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2025-59717, inspect your project dependencies using npm:
npm ls @digitalocean/do-markdownitAnalyze the terminal output to locate any version of @digitalocean/do markdownit in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The npm ls @digitalocean/do-markdownit command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-843: Access of Resource Using Incompatible Type ('Type Confusion'), where the product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. In @digitalocean/do markdownit, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-59717 Affected @digitalocean/do markdownit Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@digitalocean/do-markdownit
|
npm |
≤ 1.16.1
|
|
References
Frequently Asked Questions
What is CVE-2025-59717?
Which @digitalocean/do markdownit versions are affected?
What version fixes CVE-2025-59717?
Is @digitalocean/do-markdownit affected?
What is the CVSS score of CVE-2025-59717?
What CWE is associated with CVE-2025-59717?
How can I check npm dependencies for CVE-2025-59717?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-2h8j-8r9p-849f",
"modified" : "2025-09-22T22:55:37Z",
"published" : "2025-09-19T06:31:21Z",
"aliases" : [ "CVE-2025-59717" ],
"summary" : "@digitalocean/do-markdownit has Type Confusion vulnerability",
"details" : "### Overview\nA type confusion issue exists in the `@digitalocean/do-markdownit` package. In the `callout` and `fence_environment` plugins, the `allowedClasses` and `allowedEnvironments` options are expected to be arrays of strings. If these options are provided as a single string, the code applies `.includes` directly on the string, resulting in substring matching instead of membership checks against an array.\n\n### Affected Versions\nAll versions up to and including 1.16.1 (npm).\n\n### Impact\nSupplying crafted input can bypass intended allow-lists (e.g., class/environment constraints) due to substring checks, which may enable rendering of unintended classes or environments and lead to policy bypass in downstream consumers.\n\n### Mitigation\nUntil an upstream fix is released, ensure configuration normalization before invoking the plugins:\n- Validate that `allowedClasses` and `allowedEnvironments` are arrays (`Array.isArray(...)`), converting single strings into one-element arrays when necessary.\n- Consider sanitizing or strictly validating user-controlled values that influence Markdown rendering.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@digitalocean/do-markdownit"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "1.16.1"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-59717"
}, {
"type" : "WEB",
"url" : "https://gist.github.com/thesmartshadow/dd19665f1f51a4e3c7a766e70c9eafd0"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/digitalocean/do-markdownit"
}, {
"type" : "WEB",
"url" : "https://www.npmjs.com/package/@digitalocean/do-markdownit"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-843" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2025-09-19T17:15:44Z",
"nvd_published_at" : "2025-09-19T04:16:49Z"
}
}