org.webjars.npm:mermaid 11.12.3

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:mermaid package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Arbitrary Code Injection org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Arbitrary Code Injection via the CSS namespacing process. An attacker can manipulate the appearance or behavior of adjacent DOM elements by injecting crafted CSS selectors into diagram source content. This is only exploitable if the rendered SVG is not the only child of its parent element, such as when the SVG is manually inserted alongside other elements. How to fix Arbitrary Code Injection? Upgrade `org.webjars.npm:mermaid` to version 10.9.8, 11.16.1 or higher.	[,10.9.8)[11.0.0-alpha.1,11.16.1)
M Use of Blocking Code in Single-threaded, Non-blocking Context org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Use of Blocking Code in Single-threaded, Non-blocking Context via the `ticks` parameter in radar diagrams. An attacker can cause excessive CPU and memory consumption by specifying arbitrarily large values, leading to freezing or termination of the JavaScript process. How to fix Use of Blocking Code in Single-threaded, Non-blocking Context? Upgrade `org.webjars.npm:mermaid` to version 11.16.1 or higher.	[11.6.0,11.16.1)
L Prototype Pollution org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Prototype Pollution in the `assignWithDepth` process used by configuration APIs. An attacker can modify internal object properties by supplying specially crafted configuration objects to the `mermaid.initialize`, `mermaidAPI.setConfig`, or `mermaidAPI.updateSiteConfig` functions. This is only exploitable if an application forwards attacker-controlled data directly into these configuration entry points, which is outside their documented usage. How to fix Prototype Pollution? Upgrade `org.webjars.npm:mermaid` to version 10.9.8, 11.16.1 or higher.	[,10.9.8)[11.0.0-alpha.1,11.16.1)
M Improperly Controlled Sequential Memory Allocation org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation in the `setXAxisRangeData` function when configuring an X-Axis with invalid parameters. An attacker can cause the JavaScript process or page to crash due to memory exhaustion by supplying specially crafted input that triggers an infinite loop. How to fix Improperly Controlled Sequential Memory Allocation? Upgrade `org.webjars.npm:mermaid` to version 10.9.8, 11.16.1 or higher.	[10.6.0,10.9.8)[11.0.0-alpha.1,11.16.1)
M Prototype Pollution org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Prototype Pollution via the `architecture-beta` diagram rendering process. An attacker can inject arbitrary properties with the values `horizontal` or `vertical` into `Object.prototype` by specifying a group id of `__proto__`, which may corrupt configuration defaults, bypass truthiness checks, or cause logic corruption and denial of service in applications that process affected objects. How to fix Prototype Pollution? Upgrade `org.webjars.npm:mermaid` to version 11.16.1 or higher.	[11.5.0,11.16.1)
M Arbitrary Code Injection org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Arbitrary Code Injection due to improper sanitization of configuration options such as `fontFamily`, `themeCSS`, and `altFontFamily`. An attacker can inject arbitrary CSS that escapes diagram scoping and affects the entire page, potentially leading to page defacement or exfiltration of DOM attributes by crafting malicious configuration values. How to fix Arbitrary Code Injection? Upgrade `org.webjars.npm:mermaid` to version 11.15.0 or higher.	[,11.15.0)
M Arbitrary Code Injection org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Arbitrary Code Injection due to improper sanitization of the `classDef` function in state diagrams. An attacker can inject arbitrary HTML into the rendered output by crafting malicious diagram definitions, potentially leading to DOM manipulation and content spoofing. How to fix Arbitrary Code Injection? Upgrade `org.webjars.npm:mermaid` to version 11.15.0 or higher.	[,11.15.0)
M Arbitrary Code Injection org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Arbitrary Code Injection due to improper sanitization of input passed to the `addStyleClass` function. An attacker can inject arbitrary CSS into the rendered page by crafting malicious `classDef` values, potentially leading to page defacement, user tracking through external resource loading, or exfiltration of DOM attributes using advanced CSS selectors. How to fix Arbitrary Code Injection? Upgrade `org.webjars.npm:mermaid` to version 11.15.0 or higher.	[,11.15.0)
M Infinite loop org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Infinite loop in the rendering process of Gantt charts when the `excludes` attribute is set to exclude all dates. An attacker can cause the application to enter an infinite loop by supplying a crafted chart configuration that excludes every day of the week. How to fix Infinite loop? Upgrade `org.webjars.npm:mermaid` to version 11.15.0 or higher.	[,11.15.0)

Vulnerability

Vulnerable Version

Arbitrary Code Injection