-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mermaid | npm | >= 11.1.0, < 11.10.0 | 11.10.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists because user-controlled input (iconText) in Mermaid.js architecture diagrams is rendered as HTML without proper sanitization. The analysis of the provided commits confirms this. The introducing commit, 734bde38777c9190a5a72e96421c83424442d4e4, added the feature for text-based icons and directly used the .html() method with user input within the drawServices function. The fixing commit, 2aa83302795183ea5c65caec3da1edd6cb4791fc, remediates this by wrapping the user input with a sanitizeText function before passing it to .html(). The same sanitization was applied to the getIconSVG function as a preventative measure. Therefore, any environment using a vulnerable version of Mermaid.js to render user-provided diagrams is at risk of XSS. During exploitation, the drawServices function would be present in the runtime profile as it processes the malicious iconText.
XSS on all sites that use mermaid and render user supplied diagrams without further sanitization.
Sanitize the value of iconText before passing it to html().
Ongoing coverage of React2Shell