Skip to content
OpenAdvisories

Package · npm

mermaid

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.0
    GHSA-m4gq-x24j-jpmf

    Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify

    The following bundled files within the Mermaid NPM package contain a bundled version of DOMPurify that is vulnerable to https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674, potentially resulting in an XSS attack. This affects the built…

    mermaid npm
  • High 7.2
    CVE-2021-43861

    Incorrect sanitisation function leads to `XSS`

    Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Us…

    mermaid-js mermaid node-mermaid mermaid Debian Ubuntu npm
  • High —
    GHSA-w32g-5hqp-gg6q

    Cross-Site Scripting in mermaid

    Versions of `mermaid` prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input such as `A["<img src=invalid onerror=alert('XSS')></img>"] ` is provided to the application, it will execute the code instead of rendering it as text due to improp…

    mermaid npm