mermaid-js/mermaid · Security
Incorrect sanitisation function leads to `XSS` in mermaid
- GHSA ID
- GHSA-p3rp-vmj9-gv6v
- CVE ID
- CVE-2021-43861
- Severity
- high
- Published
- Updated
- CVSS
- 7.2 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 7.2 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
Impact
Malicious diagrams can contain javascript code that can be run at diagram readers machines.
Patches
The users should upgrade to version 8.13.8
Workarounds
You need to upgrade in order to avoid this issue.
CWEs
- CWE-20 · Improper Input Validation
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-p3rp-vmj9-gv6v ↗
- https://nvd.nist.gov/vuln/detail/CVE-2021-43861 ↗
- https://github.com/mermaid-js/mermaid/commit/066b7a0d0bda274d94a2f2d21e4323dab5776d83 ↗
- https://github.com/mermaid-js/mermaid/releases/tag/8.13.8 ↗
- https://github.com/advisories/GHSA-p3rp-vmj9-gv6v ↗