Описание
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript process for long periods of time, potentially until the process is killed from memory exhaustion. This issue is fixed in version 11.16.1.
A flaw was found in Mermaid. Mermaid Radar Diagrams are susceptible to a denial of service vulnerability. A remote attacker could exploit this by providing excessively large values for the 'ticks' parameter. This can lead to high CPU usage, causing the rendering webpage or JavaScript process to freeze and potentially terminate due to memory exhaustion.
Отчет
Red Hat ships Mermaid embedded in the same code-server based developer workbench images: OpenShift AI's odh-workbench-codeserver-datascience-cpu-py312 workbench image and OpenShift Dev Spaces' code-rhel9 image. The bundled version (>=11.6.0,<11.16.1) exposes users who render Mermaid Radar diagrams with excessively large 'ticks' values to a client-side denial of service through high CPU usage and potential process termination.
Меры по смягчению последствий
Avoid rendering untrusted Mermaid diagram content containing Radar diagrams with attacker-controlled 'ticks' parameters in the affected workbench images until the pinned mermaid dependency is upgraded to 11.16.1 or later.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Build of Podman Desktop | rh-podman-desktop.git | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 | Fix deferred | ||
| Red Hat OpenShift Dev Spaces | devspaces/code-rhel9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript process for long periods of time, potentially until the process is killed from memory exhaustion. This issue is fixed in version 11.16.1.
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript process for long periods of time, potentially until the process is killed from memory exhaustion. This issue is fixed in version 11.16.1.
Mermaid is a JavaScript tool that uses Markdown-inspired text to creat ...
EPSS
6.5 Medium
CVSS3