Executive brief
Mind-elixir is a free, open-source mind mapping library used to create interactive flowcharts and diagrams in web applications. A cross-site scripting (XSS) vulnerability in its context menu handling allows attackers to inject malicious scripts through untrusted menu data, potentially compromising user sessions or stealing sensitive information from applications that use the library.
Technical details
Mind-elixir is vulnerable to cross-site scripting (CWE-79) due to improper input sanitization in the context menu plugin (contextMenu.js). The vulnerability arises when untrusted menu data is processed without proper HTML escaping, allowing an attacker to inject arbitrary JavaScript code. The attack requires user interaction (clicking a malicious menu item) and network-reachable access to a vulnerable application. An attacker can execute arbitrary JavaScript in the victim's browser context, potentially stealing cookies, session tokens, or performing actions on behalf of the user. The vulnerability was patched in version 0.18.1 with proper input sanitization.
Affected products
- Mind-elixir mind-elixir before 0.18.1
Timeline
- 2023-02-21: disclosed
- 2021-11-25: patched: Fix committed to repository