Executive brief
Mermaid is a popular JavaScript diagram and chart rendering library used in web applications. Certain bundled versions of Mermaid contain a vulnerable version of the DOMPurify HTML sanitization library, which can be bypassed through prototype pollution attacks to inject malicious scripts (XSS), potentially compromising user sessions or stealing sensitive data from users viewing affected diagrams.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in DOMPurify that was bundled into specific Mermaid distribution files. The vulnerability allows attackers to use malicious HTML with special nesting techniques to bypass DOMPurify's depth-checking protections, enabling XSS payloads to execute in the browser. The affected bundled files are dist/mermaid.min.js, dist/mermaid.js, dist/mermaid.esm.mjs, and dist/mermaid.esm.min.mjs. Users are network-exposed when loading these files from CDNs or local sources. The default NPM export and dist/mermaid.core.mjs are not affected. Patches are available in Mermaid 10.9.3 and 11.0.0.
Affected products
- Mermaid Mermaid <= 10.9.2
Timeline
- 2024-10-22: disclosed: GHSA-m4gq-x24j-jpmf published
- 2024-10-22: patched: Patches available in versions 10.9.3 and 11.0.0