Description

Mermaid before 8.11.0 allows XSS when the antiscript feature is used.

Remediation

References

https://github.com/mermaid-js/mermaid/issues/2122

https://github.com/mermaid-js/mermaid/pull/2123

https://github.com/mermaid-js/mermaid/releases/tag/8.11.0-rc2

Related Vulnerabilities

CVE-2022-38900 Vulnerability in maven package org.webjars.bowergithub.samverschueren:decode-uri-component

CVE-2023-36472 Vulnerability in npm package @strapi/plugin-content-manager

CVE-2022-3952 Vulnerability in maven package com.manydesigns:portofino-microservice-launcher

CVE-2022-22968 Vulnerability in maven package org.springframework:spring-context

CVE-2022-36922 Vulnerability in maven package org.jenkins-ci.plugins:lucene-search

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Third Party Advisory Patch Release Notes CWE-79