Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of __proto__. Because the group id is used directly as an object property key without validation, an attacker who can supply diagram text can pollute Object.prototype, potentially affecting the behavior of the embedding application.
This issue is fixed in version 11.16.1.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
mermaid-js:mermaid
References 4
https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d6752…
security-advisories@github.com
https://github.com/mermaid-js/mermaid/pull/8022
security-advisories@github.com
https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1
security-advisories@github.com
https://github.com/mermaid-js/mermaid/security/advisories/GHSA-3rrr-jr9j-h3q3
security-advisories@github.com