Description

Mermaid before 8.11.0 allows XSS when the antiscript feature is used.

Remediation

References

https://github.com/mermaid-js/mermaid/issues/2122

https://github.com/mermaid-js/mermaid/pull/2123

https://github.com/mermaid-js/mermaid/releases/tag/8.11.0-rc2

Related Vulnerabilities

CVE-2022-39299 Vulnerability in npm package @node-saml/passport-saml

CVE-2020-2172 Vulnerability in maven package org.jenkins-ci.plugins:code-coverage-api

CVE-2019-10773 Vulnerability in maven package org.webjars.npm:yarn

CVE-2020-29204 Vulnerability in maven package com.xuxueli:xxl-job-admin

CVE-2019-1003085 Vulnerability in maven package org.jenkins-ci.plugins:zephyr-enterprise-test-management

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Third Party Advisory Patch Release Notes