CVE-2025-59717: @digitalocean/do-markdownit has Type Confusion vulnerability

September 19, 2025 (updated September 22, 2025)

Supplying crafted input can bypass intended allow-lists (e.g., class/environment constraints) due to substring checks, which may enable rendering of unintended classes or environments and lead to policy bypass in downstream consumers.

References

gist.github.com/thesmartshadow/dd19665f1f51a4e3c7a766e70c9eafd0
github.com/advisories/GHSA-2h8j-8r9p-849f
github.com/digitalocean/do-markdownit
nvd.nist.gov/vuln/detail/CVE-2025-59717
www.npmjs.com/package/@digitalocean/do-markdownit

Code Behaviors & Features

Detect and mitigate CVE-2025-59717 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →