Описание
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, directive in Mermaid state diagrams. This allows for Document Object Model (DOM) injection, which escapes the Scalable Vector Graphics (SVG) context. While <script> tags are stripped, preventing Cross-Site Scripting (XSS), this could lead to HTML injection, potentially altering the appearance or content of a web page.
Отчет
This Moderate flaw in Mermaid, a JavaScript diagramming tool, allows for HTML injection through specially crafted state diagrams. While script execution is prevented, an attacker could manipulate the rendered content, potentially leading to altered visual presentation or information disclosure. This issue primarily affects applications that process untrusted Mermaid diagram input.
Меры по смягчению последствий
To mitigate this vulnerability, configure applications utilizing Mermaid to render diagrams within a sandboxed iframe by setting the securityLevel option to sandbox. This prevents the HTML injection from escaping the SVG context and affecting the parent document. Consult the documentation for the specific application integrating Mermaid for instructions on how to apply this configuration.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Build of Podman Desktop | rh-podman-desktop.git | Fix deferred | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, <script> tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed <iframe>.
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, <script> tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed <iframe>.
Mermaid is a JavaScript tool that uses Markdown-inspired text to creat ...
Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection
EPSS
5.4 Medium
CVSS3