XSS Vulnerability in Mermaid Package: node-mermaid Affected by Antiscript Feature
Summary
CVE-2021-35513: Mermaid before 8.11.0 allows XSS when the antiscript feature is used. Affects node-mermaid across 2 version ranges.
< 1d782678715699e8485480bff309adc2b648c7c1
< 8.7.0+ds+~cs27.17.17-3
Fixed in 8.7.0+ds+~cs27.17.17-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mermaid is a JavaScript-based diagramming and charting tool that allows users to create diagrams and visualizations using a simple markdown-like syntax. It is widely used in documentation and project management tools to enhance visual communication. The node-mermaid package is a Debian package that provides the Mermaid functionality for Node.js applications. However, prior to version 8.11.0, the package is susceptible to a cross-site scripting (XSS) vulnerability when the antiscript feature is enabled, allowing attackers to inject malicious scripts.
Vulnerability Detail
The vulnerability, identified as CVE-2021-35513, arises from the improper handling of user input in the antiscript feature of the Mermaid package. This flaw can be exploited by an attacker to execute arbitrary JavaScript code in the context of the user's browser, potentially leading to data theft, session hijacking, or other malicious activities. The vulnerability affects versions of node-mermaid before 8.11.0 and can be triggered by crafting a specific input that bypasses the sanitization process.
How To Fix
Minimum fixed version
8.7.0+ds+~cs27.17.17-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-mermaidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the antiscript feature in your application until the package can be updated. This can help mitigate the risk of XSS attacks. Additionally, you can implement input validation and sanitization on user inputs to further reduce the risk.
Conclusion
The CVE-2021-35513 vulnerability in the node-mermaid package poses a significant risk due to its potential for XSS attacks. It is crucial for users of the package to update to version 8.11.0 or later to protect their applications. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for node-mermaid →
FAQ
CVE-2021-35513 is a cross-site scripting (XSS) vulnerability in the Mermaid package that allows attackers to inject malicious scripts when the antiscript feature is used.
Versions of node-mermaid prior to 8.11.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
If you cannot update the package immediately, consider disabling the antiscript feature and implementing input validation to mitigate the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-mermaid.
