Executive brief
Mermaid is a popular JavaScript library used to render diagrams from text-based descriptions in web applications. An attacker who can craft a malicious diagram can inject JavaScript code that executes in the browser of anyone viewing that diagram, potentially stealing data, hijacking sessions, or performing actions on behalf of legitimate users.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw caused by an incorrect sanitization function that fails to properly remove or escape malicious JavaScript code embedded in diagram definitions (CWE-20, CWE-79). An attacker can craft a malicious diagram containing JavaScript payloads that bypass the sanitizer and execute in the victim's browser when the diagram is rendered. The attack requires no authentication but does require the victim to view a diagram containing the payload. The vulnerability affects all versions before 8.13.8, which includes the patched sanitization logic.
Affected products
- Mermaid Mermaid before 8.13.8
Timeline
- 2021-12-29: disclosed
- 2022-01-06: advisory
- 2021-12-30: patched: Version 8.13.8 released with fix