mermaid 10.9.6

Direct Vulnerabilities

Known vulnerabilities in the mermaid package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Improperly Controlled Sequential Memory Allocation mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation in the `setXAxisRangeData` function when configuring an X-Axis with invalid parameters. An attacker can cause the JavaScript process or page to crash due to memory exhaustion by supplying specially crafted input that triggers an infinite loop. How to fix Improperly Controlled Sequential Memory Allocation? Upgrade `mermaid` to version 10.9.8, 11.16.1 or higher.	>=10.6.0 <10.9.8>=11.0.0-alpha.1 <11.16.1
L Prototype Pollution mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Prototype Pollution in the `assignWithDepth` process used by configuration APIs. An attacker can modify internal object properties by supplying specially crafted configuration objects to the `mermaid.initialize`, `mermaidAPI.setConfig`, or `mermaidAPI.updateSiteConfig` functions. This is only exploitable if an application forwards attacker-controlled data directly into these configuration entry points, which is outside their documented usage. How to fix Prototype Pollution? Upgrade `mermaid` to version 10.9.8, 11.16.1 or higher.	<10.9.8>=11.0.0-alpha.1 <11.16.1
M Arbitrary Code Injection mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Arbitrary Code Injection via the CSS namespacing process. An attacker can manipulate the appearance or behavior of adjacent DOM elements by injecting crafted CSS selectors into diagram source content. This is only exploitable if the rendered SVG is not the only child of its parent element, such as when the SVG is manually inserted alongside other elements. How to fix Arbitrary Code Injection? Upgrade `mermaid` to version 10.9.8, 11.16.1 or higher.	<10.9.8>=11.0.0-alpha.1 <11.16.1
M Cross-site Scripting (XSS) mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the `calculateMathMLDimensions` function, which was introduced in 5c69e5f. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious HTML into sequence diagram labels, which are processed and rendered without proper sanitization. How to fix Cross-site Scripting (XSS)? Upgrade `mermaid` to version 11.10.0 or higher.	>=10.9.0-rc.1 <11.10.0

Vulnerability

Vulnerable Version

Improperly Controlled Sequential Memory Allocation

mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown.

Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation in the setXAxisRangeData function when configuring an X-Axis with invalid parameters. An attacker can cause the JavaScript process or page to crash due to memory exhaustion by supplying specially crafted input that triggers an infinite loop.

How to fix Improperly Controlled Sequential Memory Allocation?

Upgrade mermaid to version 10.9.8, 11.16.1 or higher.

>=10.6.0 <10.9.8>=11.0.0-alpha.1 <11.16.1

Prototype Pollution

mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown.

Affected versions of this package are vulnerable to Prototype Pollution in the assignWithDepth process used by configuration APIs. An attacker can modify internal object properties by supplying specially crafted configuration objects to the mermaid.initialize, mermaidAPI.setConfig, or mermaidAPI.updateSiteConfig functions. This is only exploitable if an application forwards attacker-controlled data directly into these configuration entry points, which is outside their documented usage.

How to fix Prototype Pollution?

Upgrade mermaid to version 10.9.8, 11.16.1 or higher.

<10.9.8>=11.0.0-alpha.1 <11.16.1

Arbitrary Code Injection

mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the CSS namespacing process. An attacker can manipulate the appearance or behavior of adjacent DOM elements by injecting crafted CSS selectors into diagram source content. This is only exploitable if the rendered SVG is not the only child of its parent element, such as when the SVG is manually inserted alongside other elements.

How to fix Arbitrary Code Injection?

Upgrade mermaid to version 10.9.8, 11.16.1 or higher.

<10.9.8>=11.0.0-alpha.1 <11.16.1

Cross-site Scripting (XSS)

mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the calculateMathMLDimensions function, which was introduced in 5c69e5f. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious HTML into sequence diagram labels, which are processed and rendered without proper sanitization.

How to fix Cross-site Scripting (XSS)?

Upgrade mermaid to version 11.10.0 or higher.

>=10.9.0-rc.1 <11.10.0

mermaid@10.9.6

Markdown-ish syntax for generating flowcharts, mindmaps, sequence diagrams, class diagrams, gantt charts, git graphs and more.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically