Quick answers
- Is CVE-2021-43861 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-43861 being exploited in the wild.
- How severe is CVE-2021-43861?
- Low severity, with a CVSS score of 3.1, published 6 January 2022.
- Which products and versions are affected?
- mermaid (npm) SEMVER:introduced=0,fixed=8.13.8.
- Is there a fix for CVE-2021-43861?
- Yes. mermaid (npm): upgrade to 8.13.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-43861 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2021-43861?
- Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mermaid (npm): upgrade to 8.13.8 or later
npm install mermaid@8.13.8
Technical details
The vulnerability is a cross-site scripting (XSS) flaw caused by an incorrect sanitization function that fails to properly remove or escape malicious JavaScript code embedded in diagram definitions (CWE-20, CWE-79). An attacker can craft a malicious diagram containing JavaScript payloads that bypass the sanitizer and execute in the victim's browser when the diagram is rendered. The attack requires no authentication but does require the victim to view a diagram containing the payload. The vulnerability affects all versions before 8.13.8, which includes the patched sanitization logic.
Affected products
- Mermaid Mermaid before 8.13.8
Identifiers
- CVE-2021-43861
- GHSA-p3rp-vmj9-gv6v
Timeline
- 2021-12-29: disclosed
- 2022-01-06: advisory
- 2021-12-30: patched: Version 8.13.8 released with fix