Cross-Site Scripting in mermaid

published 2020-09-02 6y ago modified 2021-09-27 5y ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Versions of `mermaid` prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input such as `A["<img src=invalid onerror=alert('XSS')></img>"] ` is provided to the application, it will execute the code instead of rendering it as text due to improper output encoding.

## Recommendation

Upgrade to version 8.2.3 or later

Patch / fix

fixed in 1

npm mermaid 8.2.3

Is GHSA-w32g-5hqp-gg6q in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
npm	mermaid	<8.2.3	8.2.3

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

GitHub Advisory GHSA-w32g-5hqp-gg6q

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.