Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
16 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Mermaid radar diagrams allow arbitrary large values for ticks, which can cause high CPU usage, freezing the webpage/JavaScript process for long periods of time, until the process is eventually killed due to OOM/running out of memory. Proof-of-concept Patches Has the problem been patched? What versions should users upgrade to? This problem has been patched by https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e, which was released in Mermaid v11.16.1 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? There are no known workarounds without updating to a patched version of mermaid. References Are there any links users can visit to find out more? - https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e - https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
Recommended action: Upgrade to 11.16.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge the caller-supplied configuration object into Mermaid's internal config using the assignWithDepth deep-merge helper that is vulnerable to prototype pollution. Because these APIs are intended to receive trusted configuration supplied by the application integrating Mermaid, Mermaid assesses the practical risk as low. The vulnerability is only reachable if an application forwards attacker-controlled data directly into one of these configuration entry points, which is outside their documented usage. User-controlled configuration (e.g. configuration in diagram code using %%{init: {}}%% or YAML frontmatter) are already protected from prototype pollution. Patches This has been patched in https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43 and released in Mermaid v11.16.1. A backport has been made for the v10 branch in…
Recommended action: Upgrade to 11.16.1 or 10.9.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with #mermaid-X, sibling (~ and +) combinators can still escape the Mermaid container and inject styles to DOM elements adjacent to the diagram <svg. Most users of mermaid would not be affected by this, as mermaid adds its <svg as an only child of it's parent element. However, you may be affected if you manually insert the <svg (or other elements) into the DOM yourself. Details Mermaid namespaces CSS through with a middleware intended to scope all rules to the diagram's SVG element. CSS nesting expands & ~ { ... } to #svgId ~ , which selects all sibling elements following the SVG in the DOM, outside the diagram boundary. Impact An attacker able to supply diagram source to a page (e.g., user-generated content rendered by Mermaid) could inject CSS rules affecting sibling elements to the diagram <svg on the host page. This can be used for UI redressing, hiding content, conditional…
Recommended action: Upgrade to 11.16.1 or 10.9.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Rendering an untrusted architecture-beta diagram lets the diagram author write an arbitrary property with the value horizontal or vertical onto Object.prototype. A group id of proto is accepted as a valid parent. Impact Any code in the same realm that reads a property of that name from an arbitrary object, or enumerates an object with bare for...in, observes the injected value (which can only be the string horizontal or vertical. This may mean corrupted option/config defaults, bypassed truthiness checks, causing denial of service or logic corruption in the embedding application. Because the injected value cannot be an object or function, this is not directly exploitable for remote code execution. PoC The vulnerable write was introduced in commit cb0a4703bdf01d47508bde1c08aa9a980d70bc20 and first shipped in mermaid@11.5.0. The lines are unchanged in every release since. Patches This has been patched by…
Recommended action: Upgrade to 11.16.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the setXAxisRangeData(), when configuring an X-Axis with invalid parameters. As each loop appends an element to an array, this would generally only cause an RangeError: Invalid array length to appear after a few seconds, but may cause the page/JavaScript process to crash due to memory exhaustion, depending on the environment. Proof-of-concept Patches This has been patched in https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289 and released in Mermaid v11.16.1. A backport has been made for the v10 branch in ef60adc837d9d5107af21285f01e83dea309bd0a and was released in Mermaid v10.9.8 Workarounds There are no known workarounds. Please update to the latest version or apply the patch. References - https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289 - https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1 -…
Recommended action: Upgrade to 11.16.1 or 10.9.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options. Live demo: mermaid.live Example code: The injected CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping, applying styles to all page elements. Global at-rules (@font-face, @keyframes, @counter-style) are also injectable as stylis hoists them to top level. This allows page defacement and DOM attribute exfiltration via CSS :has() selectors. Patches - v11.15.0 (see 64769738d5b59211e1decb471ffbaca8afec51aa) - v10.9.6 (see a9d9f0d8eb790349121508688cd338253fd80d76) Workarounds If you can't upgrade mermaid, you can set the secure config value in the mermaid config to avoid allowing diagrams to modify fontFamily, themeCSS, altFontFamily, and themeVariables. Setting "securityLevel": "sandbox" will also prevent this. Credits Reported by @zsxsoft on behalf of @KeenSecurityLab
Recommended action: Upgrade to 11.15.0 or 10.9.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates. Example: mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram). Patches This has been patched in: - v11.15.0 (see faafb5d49106dd32c367f3882505f2dd625aa30e) - v10.9.6 (see a59ea56174712ee5430dfd5bc877cb5151f501a6) Workarounds There are no workarounds available without updating to a newer version of mermaid.
Recommended action: Upgrade to 11.15.0 or 10.9.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Under the default configuration, Mermaid state diagram's classDef allow DOM injection that escapes the SVG, although <script tags are removed, preventing XSS. Proof-of-concept Patches - v11.15.0 (see 37ff937f1da2e19f882fd1db01235db4d01f4056) - v10.9.6 (see 4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3) Workarounds If you can not update to a patched version, setting "securityLevel": "sandbox" will prevent this, by rendering the mermaid diagram in a sandboxed <iframe. Credits Thanks to @zsxsoft from @KeenSecurityLab for reporting this vulnerability.
Recommended action: Upgrade to 11.15.0 or 10.9.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Details The state diagram and any other diagram type that routes user-controlled style strings through createCssStyles parser for Mermaid v11.14.0 and earlier captures classDef values with an unrestricted regex: The value passes unsanitized through addStyleClass() - createCssStyles() - style.innerHTML (mermaidAPI.ts:418). A } in the value closes the generated CSS selector, and everything after becomes a new CSS rule on the page. PoC Live demo: <https://mermaid.live/edit#pako:eNpFjzFvgzAQhf-KdVNbEcBgMHhtlkqtOnSJKi8ONsYKBmRMlRTx3-skanvTfbp7996t0IxSAYPZC62Rmgn7O4rQ00v5nmvWnRG29OKjqI5aTcug9wZK7RiaHH9A4fO-4kliVXSiFibqbvEzWjvnHxofI6vR3e6cGXyX2qTcvhcYMItDMSmHeLisAqZ8UVYeUDQhx8p6ziwEIrhTtx4MNVM4nhcxztrywE0h2wVvRzoGWSz8rahBKvcckntgmN5OAFvhDIzUNCZZQXCR5nVaZkUEF2BVFpOcEkoxxhUuyRbB980yjStapKHqoKFlhvPtB7BFZEU Patches This has been patched in: - v11.15.0 (see e9b0f34d8d82a6260077764ee45e1d7d90957a0f) - v10.9.6 (see 8fead23c59166b7bab6a39eac81acebee2859102) Workarounds Setting "securityLevel":…
Recommended action: Upgrade to 11.15.0 or 10.9.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In the default configuration of mermaid 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS. Details Sequence diagram node labels with KaTeX delimiters are passed through calculateMathMLDimensions. This method passes the full label to innerHTML which allows allows malicious users to inject arbitrary HTML and cause XSS when mermaid-js is used in it's default configuration (with KaTeX support enabled). The vulnerability lies here: The calculateMathMLDimensions method was introduced in 5c69e5fdb004a6d0a2abe97e23d26e223a059832 two years ago, which was released in Mermaid 10.9.0. PoC Render the following diagram and observe the modified DOM. Here is a PoC on mermaid.live:…
Recommended action: Upgrade to 11.10.0 or 10.9.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In the default configuration of mermaid 11.9.0, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting. Details Architecture diagram service iconText values are passed to the d3 html() method, allowing malicious users to inject arbitrary HTML and cause XSS when mermaid-js is used in it's default configuration. The vulnerability lies here: This issue was introduced with 734bde38777c9190a5a72e96421c83424442d4e4, around 15 months ago, which was released in v11.1.0. PoC Render the following diagram and observe the modified DOM. Here is a PoC on mermaid.live:…
Recommended action: Upgrade to 11.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The following bundled files within the Mermaid NPM package contain a bundled version of DOMPurify that is vulnerable to https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674, potentially resulting in an XSS attack. This affects the built: - dist/mermaid.min.js - dist/mermaid.js - dist/mermaid.esm.mjs - dist/mermaid.esm.min.mjs This will also affect users that use the above files via a CDN link, e.g. https://cdn.jsdelivr.net/npm/mermaid@10.9.2/dist/mermaid.min.js Users that use the default NPM export of mermaid, e.g. import mermaid from 'mermaid', or the dist/mermaid.core.mjs file, do not use this bundled version of DOMPurify, and can easily update using their package manager with something like npm audit fix. Patches - develop branch: 6c785c93166c151d27d328ddf68a13d9d65adc00 - backport to v10: 92a07ffe40aab2769dd1c3431b4eb5beac282b34
Recommended action: Upgrade to 10.9.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the generated graph, and potentially exfiltrate sensitive information by using specially crafted CSS selectors. The following example shows how an attacker can exfiltrate the contents of an input field by bruteforcing the value attribute one character at a time. Whenever there is an actual match, an http request will be made by the browser in order to "load" a background image that will let an attacker know what's the value of the character. Patches Has the problem been patched? What versions should users upgrade to? Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? References Are there any links users can visit to find out more? For more information If you have any questions or comments about this advisory: Open an issue in example link to repo Email us at example email address Product mermaid.js Tested Version…
Recommended action: Upgrade to 9.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Malicious diagrams can contain javascript code that can be run at diagram readers machines. Patches The users should upgrade to version 8.13.8 Workarounds You need to upgrade in order to avoid this issue.
Recommended action: Upgrade to 8.13.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
Recommended action: Upgrade to 8.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of mermaid prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input such as A["<img src=invalid onerror=alert('XSS')</img"] is provided to the application, it will execute the code instead of rendering it as text due to improper output encoding. Recommendation Upgrade to version 8.2.3 or later
Recommended action: Upgrade to 8.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.