Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge caller-supplied configuration into Mermaid's internal config using the assignWithDepth deep-merge helper, which is vulnerable to prototype pollution. This is only exploitable if an application forwards untrusted data directly into one of these configuration entry points, which is outside their documented usage; diagram-supplied configuration (e.g. %%{init: {}}%% or YAML frontmatter) is not affected.
This issue is fixed in versions 10.9.8 and 11.16.1.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
High
Admin privileges needed
User Interaction
Active
User action required
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
mermaid-js:mermaid
References 6
https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870…
security-advisories@github.com
https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1…
security-advisories@github.com
https://github.com/mermaid-js/mermaid/pull/8022
security-advisories@github.com
https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
security-advisories@github.com
https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8
security-advisories@github.com
https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v
security-advisories@github.com