Executive brief
Mermaid is a popular JavaScript library used to generate diagrams (flowcharts, sequence diagrams, etc.) from text input, commonly embedded in web applications and documentation. Versions before 8.2.3 fail to properly encode user input, allowing attackers to inject malicious HTML and JavaScript code that executes in the browser. An attacker could exploit this to steal session cookies, redirect users to phishing sites, or perform actions on behalf of legitimate users.
Technical details
This is a classic Cross-Site Scripting (CWE-79) vulnerability in mermaid's diagram rendering engine. The vulnerability stems from improper output encoding when processing user-supplied diagram text; malicious payloads such as HTML img tags with onerror event handlers are rendered as executable code rather than escaped text. The attack vector is network-based and requires user interaction (the user must input or view a diagram containing the malicious payload). An attacker can execute arbitrary JavaScript in the context of the victim's browser session. The fix is available in version 8.2.3 and later.
Affected products
- mermaid-js mermaid before 8.2.3
Timeline
- 2020-09-02: disclosed
- 2020: patched: fix released in version 8.2.3