Executive brief
ZenUML is a diagram library used to render sequence diagrams from code. The library fails to sanitize markdown-formatted comments before rendering them, allowing attackers to inject malicious JavaScript that executes in applications using ZenUML to display user-supplied diagrams. This could lead to credential theft, session hijacking, or defacement of applications that embed ZenUML without proper sandboxing.
Technical details
This is a stored/reflected cross-site scripting (XSS) vulnerability in the Comment component of ZenUML. The root cause is insufficient input sanitization: the component uses the marked markdown parser on user-supplied comment text without sanitizing the resulting HTML output before rendering (Comment.vue line 65). An attacker can embed HTML/JavaScript payloads in diagram comments (e.g., <img onerror=alert(1) src="">) which execute in the renderer's context. No authentication or user interaction is required beyond supplying a malicious diagram. The vulnerability affects all versions up to and including 3.0.0; patched in version 3.23.25 and later. Attack vector is network-based with moderate complexity (requires diagram input), and scope is changed (XSS affects downstream consumers of rendered diagrams).
Affected products
- mermaid-js @zenuml/core <=3.0.0
Timeline
- 2024-06-26: disclosed
- 2024-06-26: patched: Fixed in version 3.23.25