Improper Control of Generation of Code ('Code Injection') in mdx-mermaid
- Severity:
- Low
Description
Arbitary javascript injection
Modify any mermaid code blocks with the following code and the code inside will execute when the component is loaded by MDXjs
The block below shows a valid mermaid code block
mermaid graph TD; A–>B; A–>C; B–>D; C–>D; `
The same block but with the exploit added
mermaid ` + (function () { alert
Recommendation
Update the mdx-mermaid package to the latest compatible version. Followings are version details:
Affected version(s): **= 2.0.0-rc1 < 1.3.0** Patched version(s): **2.0.0-rc2 1.3.0**
References
Related Issues
- Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde - CVE-2026-26974
- Improper Control of Generation of Code in doT - CVE-2020-8141
- Unsanitized JavaScript code injection possible in gatsby-plugin-mdx - CVE-2022-25863
- Valine code injection vulnerability - CVE-2022-38545
You might also like:
- Tags:
- npm
- mdx-mermaid
Anything's wrong? Let us know Last updated on January 29, 2023