Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 22 October 2024.

Which products and versions are affected?

mermaid (npm) SEMVER:introduced=0,fixed=10.9.3.

Is there a fix for This vulnerability?

Yes. mermaid (npm): upgrade to 10.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Mermaid prototype pollution in bundled DOMPurify

Severity: low · CVSS 3.1 · Published 2024-10-22

Mermaid is a popular JavaScript diagram and chart rendering library used in web applications. Certain bundled versions of Mermaid contain a vulnerable version of the DOMPurify HTML sanitization library, which can be bypassed through prototype pollution attacks to inject malicious scripts (XSS), potentially compromising user sessions or stealing sensitive data from users viewing affected diagrams.

Technologies: mermaid (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 22 October 2024.
Which products and versions are affected?: mermaid (npm) SEMVER:introduced=0,fixed=10.9.3.
Is there a fix for This vulnerability?: Yes. mermaid (npm): upgrade to 10.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mermaid (npm): upgrade to 10.9.3 or later
```
npm install mermaid@10.9.3
```

Technical details

This is a prototype pollution vulnerability (CWE-1321) in DOMPurify that was bundled into specific Mermaid distribution files. The vulnerability allows attackers to use malicious HTML with special nesting techniques to bypass DOMPurify's depth-checking protections, enabling XSS payloads to execute in the browser. The affected bundled files are dist/mermaid.min.js, dist/mermaid.js, dist/mermaid.esm.mjs, and dist/mermaid.esm.min.mjs. Users are network-exposed when loading these files from CDNs or local sources. The default NPM export and dist/mermaid.core.mjs are not affected. Patches are available in Mermaid 10.9.3 and 11.0.0.

Affected products

Mermaid Mermaid <= 10.9.2

Timeline

2024-10-22: disclosed: GHSA-m4gq-x24j-jpmf published
2024-10-22: patched: Patches available in versions 10.9.3 and 11.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.