GHSA-P3RP-VMJ9-GV6V
Vulnerability from github – Published: 2022-01-06 19:45 – Updated: 2022-01-06 19:02
VLAI?
Summary
Incorrect sanitisation function leads to `XSS` in mermaid
Details
Impact
Malicious diagrams can contain javascript code that can be run at diagram readers machines.
Patches
The users should upgrade to version 8.13.8
Workarounds
You need to upgrade in order to avoid this issue.
Severity ?
7.2 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "mermaid"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.13.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-43861"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-06T19:02:22Z",
"nvd_published_at": "2021-12-30T14:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nMalicious diagrams can contain javascript code that can be run at diagram readers machines.\n\n### Patches\nThe users should upgrade to version 8.13.8\n\n### Workarounds\nYou need to upgrade in order to avoid this issue.\n",
"id": "GHSA-p3rp-vmj9-gv6v",
"modified": "2022-01-06T19:02:22Z",
"published": "2022-01-06T19:45:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-p3rp-vmj9-gv6v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43861"
},
{
"type": "WEB",
"url": "https://github.com/mermaid-js/mermaid/commit/066b7a0d0bda274d94a2f2d21e4323dab5776d83"
},
{
"type": "PACKAGE",
"url": "https://github.com/mermaid-js/mermaid"
},
{
"type": "WEB",
"url": "https://github.com/mermaid-js/mermaid/releases/tag/8.13.8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Incorrect sanitisation function leads to `XSS` in mermaid"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…