PT-2024-40360 · Dompurify+1 · Dompurify+1

Published 2024-10-22 · Updated 2024-10-22

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Mermaid versions prior to the version containing the fix for the DOMPurify vulnerability

Description The Mermaid NPM package contains a vulnerable version of DOMPurify, potentially resulting in an XSS attack. This issue affects users who use certain bundled files, such as dist/mermaid.min.js, dist/mermaid.js, dist/mermaid.esm.mjs, and dist/mermaid.esm.min.mjs, either directly or via a CDN link. Users who use the default NPM export of mermaid or the dist/mermaid.core.mjs file are not affected.

Recommendations For versions prior to the fixed version, update the Mermaid package using a package manager, such as npm audit fix, to obtain the patched version. As a temporary workaround, consider avoiding the use of the bundled files that contain the vulnerable DOMPurify version.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-1395

Related Identifiers

GHSA-M4GQ-X24J-JPMF

Affected Products

Dompurify

Mermaid

References · 6

• https://osv.dev/vulnerability/GHSA-m4gq-x24j-jpmf · Vendor Advisory
• https://github.com/mermaid-js/mermaid · Note
• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-m4gq-x24j-jpmf · Note
• https://github.com/mermaid-js/mermaid/commit/6c785c93166c151d27d328ddf68a13d9d65adc00 · Note
• https://github.com/mermaid-js/mermaid/commit/92a07ffe40aab2769dd1c3431b4eb5beac282b34 · Note
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674 · Note