org.webjars.npm:mermaid 11.15.0

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:mermaid package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Arbitrary Code Injection org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Arbitrary Code Injection via the CSS namespacing process. An attacker can manipulate the appearance or behavior of adjacent DOM elements by injecting crafted CSS selectors into diagram source content. This is only exploitable if the rendered SVG is not the only child of its parent element, such as when the SVG is manually inserted alongside other elements. How to fix Arbitrary Code Injection? Upgrade `org.webjars.npm:mermaid` to version 10.9.8, 11.16.1 or higher.	[,10.9.8)[11.0.0-alpha.1,11.16.1)
M Use of Blocking Code in Single-threaded, Non-blocking Context org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Use of Blocking Code in Single-threaded, Non-blocking Context via the `ticks` parameter in radar diagrams. An attacker can cause excessive CPU and memory consumption by specifying arbitrarily large values, leading to freezing or termination of the JavaScript process. How to fix Use of Blocking Code in Single-threaded, Non-blocking Context? Upgrade `org.webjars.npm:mermaid` to version 11.16.1 or higher.	[11.6.0,11.16.1)
L Prototype Pollution org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Prototype Pollution in the `assignWithDepth` process used by configuration APIs. An attacker can modify internal object properties by supplying specially crafted configuration objects to the `mermaid.initialize`, `mermaidAPI.setConfig`, or `mermaidAPI.updateSiteConfig` functions. This is only exploitable if an application forwards attacker-controlled data directly into these configuration entry points, which is outside their documented usage. How to fix Prototype Pollution? Upgrade `org.webjars.npm:mermaid` to version 10.9.8, 11.16.1 or higher.	[,10.9.8)[11.0.0-alpha.1,11.16.1)
M Improperly Controlled Sequential Memory Allocation org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation in the `setXAxisRangeData` function when configuring an X-Axis with invalid parameters. An attacker can cause the JavaScript process or page to crash due to memory exhaustion by supplying specially crafted input that triggers an infinite loop. How to fix Improperly Controlled Sequential Memory Allocation? Upgrade `org.webjars.npm:mermaid` to version 10.9.8, 11.16.1 or higher.	[10.6.0,10.9.8)[11.0.0-alpha.1,11.16.1)
M Prototype Pollution org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Prototype Pollution via the `architecture-beta` diagram rendering process. An attacker can inject arbitrary properties with the values `horizontal` or `vertical` into `Object.prototype` by specifying a group id of `__proto__`, which may corrupt configuration defaults, bypass truthiness checks, or cause logic corruption and denial of service in applications that process affected objects. How to fix Prototype Pollution? Upgrade `org.webjars.npm:mermaid` to version 11.16.1 or higher.	[11.5.0,11.16.1)

Vulnerability

Vulnerable Version

Arbitrary Code Injection