CVE-2022-36036 Improper Control of Generation of Code ('Code Injection') in mdx-mermaid
Attackers can execute arbitrary JavaScript by modifying Mermaid code blocks in MDX files, affecting users of the mdx-mermaid library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-36036?
CVE-2022-36036 is a low-severity code injection vulnerability in sjwall mdx-mermaid, published on 29 Aug 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less than 1.3.0 and 2.0.0-rc1. Modify any mermaid code blocks with arbitrary code and it will execute when the component is loaded by MDXjs. This vulnerability was patched in version(s) 1.3.0 and 2.0.0-rc2. There are currently no known workarounds.
Weakness: CWE-94
Which versions are affected by CVE-2022-36036?
4 open source packages ship an affected version, including mdx-mermaid. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mdx-mermaid npm | All versions | 1.3.0 |
mdx-mermaid npm | All versions | 1.3.0 |
mdx-mermaid npm | From 2.0.0-rc1 | 2.0.0-rc2 |
mdx-mermaid npm | From 2.0.0-rc1 | 2.0.0-rc2 |
Products include Mdx-Mermaid Project Mdx-Mermaid.
How do I fix CVE-2022-36036?
Upgrade mdx-mermaid to a fixed version for your release line: 1.3.0 or 2.0.0-rc2.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-36036 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-36036 exists.
Sources
Also known as GHSA-rvgm-35jw-q628.