Security Researchers Discover Critical XSS Vulnerabilities in Mintlify Platform Affecting Major Tech Companies
By
hackermondev
Hot, fresh, and worth queueing round the block for.
Summary
A 16-year-old hacker and his friends discovered critical cross-site scripting vulnerabilities in Mintlify, an AI documentation platform used by major companies including X (Twitter), Vercel, Cursor, and Discord. The vulnerabilities allowed attackers to inject malicious scripts into company documentation pages, potentially stealing credentials and enabling supply-chain attacks affecting hundreds of companies. The article details their discovery process, the security implications, and how they responsibly disclosed the issues to Mintlify.
Key quotes
· 3 pulledhi, i'm daniel. i'm a 16-year-old high school senior. in my free time, i hack billion dollar companies and build cool stuff.
i found a critical cross-site scripting vulnerability that, if abused, would let an attacker to inject malicious scripts into the documentation of numerous companies and steal credentials
about a month ago, a couple of friends and I found serious critical vulnerabilities on Mintlify, an AI documentation platform used by some of the top companies in the world
You might also wanna read
Microsoft uncovers supply chain attack: Compromised @antv npm packages steal CI/CD credentials via Mini Shai-Hulud malware
Microsoft has identified an active supply chain attack targeting the @antv npm package ecosystem. A threat actor compromised an @antv mainta
Zapier fixes five-bug vulnerability chain that could have enabled widespread account takeover
Security researchers at Token Security discovered a chain of five vulnerabilities in Zapier, a popular workflow automation service. The flaw
cyberscoop.com·2d ago
GitHub patches critical remote code execution vulnerability in under six hours after AI-assisted discovery
GitHub patched a critical remote code execution vulnerability in under six hours last month. The flaw, discovered by Wiz Research using AI m
The Verge·1mo ago
Microsoft uncovers npm supply chain attack stealing cloud and CI/CD credentials via typosquatted packages
Microsoft identified an active supply chain attack (Mini Shai-Hulud campaign) targeting the npm package ecosystem. On May 28, 2026, a threat
Microsoft's NLWeb Protocol Faces Early Security Flaw, Exposing Sensitive Data
Researchers discovered a critical vulnerability in Microsoft's NLWeb protocol, which was recently introduced as a revolutionary tool for int
The Verge·9mo ago
npm malware targeting Claude users leaks own GitHub token, reaches 676 downloads
An npm package called "mouse5212-super-formatter" targeting Claude users acted as information-stealing malware, reaching 676 downloads befor
theregister.com·2d ago