GHSA-m4gq-x24j-jpmf Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify

Not scored Published 22 Oct 2024

Attackers can execute arbitrary JavaScript via XSS in Mermaid diagrams when using specific bundled distribution files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-m4gq-x24j-jpmf?

GHSA-m4gq-x24j-jpmf is a cross-site scripting vulnerability in mermaid, published on 22 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The following bundled files within the Mermaid NPM package contain a bundled version of DOMPurify that is vulnerable to https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674, potentially resulting in an XSS attack.

This affects the built:

dist/mermaid.min.js
dist/mermaid.js
dist/mermaid.esm.mjs
dist/mermaid.esm.min.mjs

This will also affect users that use the above files via a CDN link, e.g. https://cdn.jsdelivr.net/npm/[email protected]/dist/mermaid.min.js

Users that use the default NPM export of mermaid, e.g. import mermaid from 'mermaid', or the dist/mermaid.core.mjs file, do not use this bundled version of DOMPurify, and can easily update using their package manager with something like npm audit fix.

Patches

develop branch: 6c785c93166c151d27d328ddf68a13d9d65adc00
backport to v10: 92a07ffe40aab2769dd1c3431b4eb5beac282b34

Which versions are affected by GHSA-m4gq-x24j-jpmf?

2 open source packages ship an affected version, including mermaid.

Package	Affected	Fixed in
`mermaid` npm	All versions	`10.9.3`
`mermaid` npm	All versions	`10.9.3`

How do I fix GHSA-m4gq-x24j-jpmf?

Upgrade mermaid to 10.9.3 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is GHSA-m4gq-x24j-jpmf being exploited?

There is no known exploitation of GHSA-m4gq-x24j-jpmf in the wild and no public exploit code.