Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify

Description

The following bundled files within the Mermaid NPM package contain a bundled version of DOMPurify that is vulnerable to https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674, potentially resulting in an XSS attack.

Recommendation

Update the mermaid package to the latest compatible version. Followings are version details:

• Affected version(s): <= 10.9.2
• Patched version(s): 10.9.3

References

• GHSA-m4gq-x24j-jpmf
• CWE-1321
• CWE-1395

Related Issues

• Prototype Pollution in lodash.defaultsdeep - lodash.defaultsdeep - Vulnerability
• Prototype pollution vulnerability in 'libnested - CVE-2020-28283
• canvg Prototype Pollution vulnerability - CVE-2025-25977
• dset Prototype Pollution vulnerability - CVE-2024-21529

You might also like:

Exploiting Server Version Disclosure

Better Passive Vulnerability Testing with SmartScanner version 1.7

Update Cheat Sheet for Developers

Tags:

npm

mermaid