Improper Control of Generation of Code ('Code Injection') in mdx-mermaid

Description

Arbitary javascript injection

Modify any mermaid code blocks with the following code and the code inside will execute when the component is loaded by MDXjs

The block below shows a valid mermaid code block

mermaid graph TD; A–>B; A–>C; B–>D; C–>D; `

The same block but with the exploit added

mermaid ` + (function () { alert

Recommendation

Update the mdx-mermaid package to the latest compatible version. Followings are version details:

• Affected version(s): **= 2.0.0-rc1

  < 1.3.0**

• Patched version(s): **2.0.0-rc2

  1.3.0**

References

• GHSA-rvgm-35jw-q628
• CVE-2022-36036
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6