Fluid Attacks Database

Description

Incorrect sanitisation function leads to XSS in mermaid

Impact

Malicious diagrams can contain javascript code that can be run at diagram readers machines.

Patches

The users should upgrade to version 8.13.8

Workarounds

You need to upgrade in order to avoid this issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	mermaid	>=0 <8.13.8	8.13.8
debian 11	node-mermaid	=8.7.0+ds+~cs27.17.17-3 \|\| =8.7.0+ds+~cs27.17.17-3+deb11u1 \|\| >=0 <8.7.0+ds+~cs27.17.17-3+deb11u2	8.7.0+ds+~cs27.17.17-3+deb11u2
debian 14	node-mermaid	=8.11.0+ds+~cs29.13.22-1 \|\| =8.13.2+ds+~cs30.13.21-1 \|\| =8.13.2+ds+~cs30.13.21-1.1 \|\| =8.13.3+ds+~cs26.13.21-1 \|\| =8.13.3+ds+~cs26.13.21-2 \|\| =8.7.0+ds+~cs27.17.17-1 \|\| =8.7.0+ds+~cs27.17.17-2 \|\| =8.7.0+ds+~cs27.17.17-2~bpo10+1 \|\| =8.7.0+ds+~cs27.17.17-3 \|\| =8.9.1+ds+~cs26.20.25-1 \|\| =8.9.3+ds+~cs29.13.19-1 \|\| >=0 <8.13.8+~cs10.4.16-1	8.13.8+~cs10.4.16-1

Aliases

References

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.