Incorrect sanitisation function leads to `XSS` in mermaid · CVE-2021-43861 · GitHub Advisory Database · GitHub

Incorrect sanitisation function leads to `XSS` in mermaid

High severity GitHub Reviewed Published Dec 29, 2021 in mermaid-js/mermaid • Updated Feb 3, 2023

Package

mermaid (npm)

Affected versions

< 8.13.8

Patched versions

8.13.8

Description

Impact

Malicious diagrams can contain javascript code that can be run at diagram readers machines.

Patches

The users should upgrade to version 8.13.8

Workarounds

You need to upgrade in order to avoid this issue.

References

knsv published to mermaid-js/mermaid

Dec 29, 2021

Published by the National Vulnerability Database

Dec 30, 2021

Reviewed Jan 6, 2022

Published to the GitHub Advisory Database Jan 6, 2022

Last updated Feb 3, 2023

Severity

High

7.2

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H