GitHub Advisoryadvisory · npm

GHSA-w32g-5hqp-gg6q Cross-Site Scripting in mermaid

HIGH Published 2020-09-02 Modified 2021-09-27 Official page ↗
Ecosystem
npm
Packages
mermaid
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm mermaid: < 8.2.3 → fixed in 8.2.3

Description

Versions of `mermaid` prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input such as `A[""] ` is provided to the application, it will execute the code instead of rendering it as text due to improper output encoding. Recommendation Upgrade to version 8.2.3 or later

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References