PT-2022-23132 · Unknown · Mdx-Mermaid

Sjwall · Published 2022-08-29 · Updated 2022-09-01 · CVE-2022-36036

Positive Technologies (AI Summary)

CVSS v3.1

3.6

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions mdx-mermaid versions less than 1.3.0 mdx-mermaid versions 2.0.0-rc1

Description The issue concerns an arbitrary JavaScript injection potential in mdx-mermaid. This can be exploited by modifying mermaid code blocks with arbitrary code, which will execute when the component is loaded by MDXjs. There are no known workarounds for this issue.

Recommendations For mdx-mermaid versions less than 1.3.0, update to version 1.3.0 or later. For mdx-mermaid version 2.0.0-rc1, update to version 2.0.0-rc2 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-36036

GHSA-RVGM-35JW-Q628

Affected Products

Mdx-Mermaid

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36036.json · Exploit
• 🔥 https://github.com/sjwall/mdx-mermaid/security/advisories/GHSA-rvgm-35jw-q628 · Exploit
• https://github.com/sjwall/mdx-mermaid/commit/f2b99386660fd13316823529c3f1314ebbcdfd2a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36036 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36036 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rvgm-35jw-q628 · Vendor Advisory
• https://github.com/sjwall/mdx-mermaid · Note
• https://t.me/cibsecurity/49003 · Telegram Post