Executive brief
Mermaid is a JavaScript library used to create diagrams and flowcharts from text descriptions. The antiscript security feature, which is meant to block malicious JavaScript code, fails to properly sanitize javascript: URLs, allowing attackers to inject arbitrary JavaScript that executes in users' browsers. This could enable credential theft, session hijacking, or malware distribution to anyone viewing a diagram created by an attacker.
Technical details
Mermaid is a diagram rendering library for web applications. The vulnerability is a stored/reflected XSS flaw in the antiscript option, which claims to block malicious script content. The root cause is inadequate sanitization of javascript: URLs in diagram elements (such as links in SVG nodes). An attacker can craft a malicious diagram definition containing javascript: protocol URLs that execute arbitrary JavaScript when a user views the rendered diagram in a browser. No authentication is required; the attack vector is network-based and requires user interaction (opening/viewing the diagram). The vulnerability was patched in version 8.11.0, which adds proper filtering of javascript: URLs when antiscript mode is enabled. The fix involves stripping javascript: protocol handlers before rendering diagram elements.
Affected products
- mermaid-js mermaid before 8.11.0
Timeline
- 2021-06-27: disclosed: Vulnerability reported and discussed in GitHub issue #2122
- 2021-06-27: patched: Fix merged in PR #2123
- 2021-12-10: advisory: GitHub Security Advisory GHSA-4f6x-49g2-99fm published