HOW WE PWNED X (TWITTER), VERCEL, CURSOR, DISCORD, AND HUNDREDS OF COMPANIES THROUGH A SUPPLY-CHAIN ATTACK

Summary from the TLDR Dev newsletter

Daniel, a 16-year-old hacker, along with friends, uncovered supply-chain vulnerabilities in Mintlify, an AI documentation platform used by many top companies. Daniel specifically found a cross-site scripting (XSS) vulnerability that allowed malicious scripts to be injected into documentation through SVG files, exploiting Mintlify's internal file fetching. This flaw had a widespread impact, affecting major customers like Discord, X (Twitter), Vercel, and Cursor, but Mintlify quickly fixed the issue once the hackers notified it.