CVE-2021-43861: XSS Vulnerability in mermaid
Summary
CVE-2021-43861: Incorrect sanitisation function leads to XSS in mermaid. Affects mermaid versions < 8.13.8. Fixed in 8.13.8. How to fix ↓
Also tracked for
- node-mermaid · Debian:11
The same CVE-2021-43861 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mermaid is an npm package that allows users to generate diagrams and flowcharts using a simple markdown-like syntax. It is widely used in various applications and websites to visualize complex data and processes. However, a vulnerability has been discovered in mermaid that allows for cross-site scripting (XSS) attacks. This means that malicious diagrams can contain JavaScript code that can be executed on the machines of users viewing the diagrams.
Vulnerability Detail
The XSS vulnerability in mermaid arises from an incorrect sanitization function. When generating diagrams, mermaid fails to properly sanitize user input, allowing for the injection of malicious JavaScript code. This code can then be executed in the context of the diagram reader's browser, potentially leading to unauthorized access, data theft, or other malicious activities. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.2.
How To Fix
Latest published version: 12.2.0 as of 22 Oct 2026
npm install mermaid@12.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.13.8
This is the first release that contains the fix.
npm install mermaid@8.13.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is strongly advised to upgrade to the latest version of mermaid to ensure the security of your application or website.
Conclusion
In conclusion, the mermaid package is vulnerable to an XSS attack due to an incorrect sanitization function. To mitigate this vulnerability, it is crucial to upgrade to version 8.13.8 or later. Failure to address this issue may result in unauthorized access, data theft, or other malicious activities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mermaid →
FAQ
Mermaid is an npm package used for generating diagrams and flowcharts using a simple markdown-like syntax. It is commonly used in various applications and websites.
An XSS vulnerability allows for the injection of malicious code into a web application, which can then be executed in the context of the user's browser. This can lead to unauthorized access, data theft, or other malicious activities.
The impact of this vulnerability is that malicious diagrams can contain JavaScript code that can be executed on the machines of users viewing the diagrams. This can lead to unauthorized access, data theft, or other malicious activities.
To fix this vulnerability, you should upgrade to version 8.13.8 or later of the mermaid package. This version includes a patch that addresses the XSS vulnerability.
There is no specific workaround mentioned for this vulnerability. However, upgrading to the latest version of mermaid is the recommended course of action.
References
Related vulnerabilities
Recent vulnerabilities recorded for mermaid.
