# CVE-2021-43861: Mermaid incorrect sanitization leading to XSS

Source: https://junglewise.ai/threats/cve-2021-43861-mermaid-incorrect-sanitization-leading-to-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-01-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-43861 · Severity: low · CVSS 3.1 · Published 2022-01-06

Mermaid is a popular JavaScript library used to render diagrams from text-based descriptions in web applications. An attacker who can craft a malicious diagram can inject JavaScript code that executes in the browser of anyone viewing that diagram, potentially stealing data, hijacking sessions, or performing actions on behalf of legitimate users.

Technologies: [mermaid (npm)](https://junglewise.ai/threats/technologies/mermaid). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-43861 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-43861 being exploited in the wild.

**How severe is CVE-2021-43861?** Low severity, with a CVSS score of 3.1, published 6 January 2022.

**Which products and versions are affected?** mermaid (npm) SEMVER:introduced=0,fixed=8.13.8.

**Is there a fix for CVE-2021-43861?** Yes. mermaid (npm): upgrade to 8.13.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-43861 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-43861?** Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mermaid (npm): upgrade to 8.13.8 or later

  ```sh
  npm install mermaid@8.13.8
  ```


## Technical details

The vulnerability is a cross-site scripting (XSS) flaw caused by an incorrect sanitization function that fails to properly remove or escape malicious JavaScript code embedded in diagram definitions (CWE-20, CWE-79). An attacker can craft a malicious diagram containing JavaScript payloads that bypass the sanitizer and execute in the victim's browser when the diagram is rendered. The attack requires no authentication but does require the victim to view a diagram containing the payload. The vulnerability affects all versions before 8.13.8, which includes the patched sanitization logic.

## Affected products

- Mermaid Mermaid before 8.13.8

## Identifiers

- CVE-2021-43861
- GHSA-p3rp-vmj9-gv6v

## Timeline

- 2021-12-29: disclosed
- 2022-01-06: advisory
- 2021-12-30: patched: Version 8.13.8 released with fix

## References

- [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-p3rp-vmj9-gv6v](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-p3rp-vmj9-gv6v)

## Related threats

- [Mermaid radar diagrams denial of service via unchecked ticks input](https://junglewise.ai/threats/cve-2026-71439-mermaid-radar-diagrams-denial-of-service-via-unchecked-ticks)
- [Mermaid prototype pollution in configuration APIs](https://junglewise.ai/threats/cve-2026-71438-mermaid-prototype-pollution-in-configuration-apis)
- [Mermaid prototype pollution in architecture-beta diagrams](https://junglewise.ai/threats/cve-2026-71437-mermaid-prototype-pollution-in-architecture-beta-diagrams)
- [Mermaid infinite loop in XY Charts axis processing](https://junglewise.ai/threats/cve-2026-71436-mermaid-infinite-loop-in-xy-charts-axis-processing)
- [Mermaid CSS injection via sibling combinators](https://junglewise.ai/threats/cve-2026-50159-mermaid-css-injection-via-sibling-combinators)