GitHub Advisoryadvisory · npm

GHSA-p3rp-vmj9-gv6v Incorrect sanitisation function leads to `XSS` in mermaid

HIGH Published 2022-01-06 Modified 2022-01-06 Official page ↗

Aliases: CVE-2021-43861
Ecosystem: npm
Packages: mermaid
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-20, CWE-79
Reviewed: 2022-01-06

Affected packages

• npm mermaid: < 8.13.8 → fixed in 8.13.8

Description

Impact Malicious diagrams can contain javascript code that can be run at diagram readers machines. Patches The users should upgrade to version 8.13.8 Workarounds You need to upgrade in order to avoid this issue.

Alias · CVE (1)

CVE-2021-43861 Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and… vulnerability

Weakness · CWE (2)

CWE-20 Improper Input Validation weakness
CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References

https://github.com/mermaid-js/mermaid/security/advisories/GHSA-p3rp-vmj9-gv6v web
https://nvd.nist.gov/vuln/detail/CVE-2021-43861 advisory
https://github.com/mermaid-js/mermaid/commit/066b7a0d0bda274d94a2f2d21e4323dab5776d83 web
https://github.com/mermaid-js/mermaid package
https://github.com/mermaid-js/mermaid/releases/tag/8.13.8 web