What is GHSA-p3rp-vmj9-gv6v?

GHSA-p3rp-vmj9-gv6v is a security advisory published by GitHub Security Advisories with High severity. Incorrect sanitisation function leads to `XSS` in mermaid

Which CVE IDs does GHSA-p3rp-vmj9-gv6v cover?

GHSA-p3rp-vmj9-gv6v covers the following CVE IDs: CVE-2021-43861. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p3rp-vmj9-gv6v?

GHSA-p3rp-vmj9-gv6v has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-p3rp-vmj9-gv6v?

GHSA-p3rp-vmj9-gv6v affects 1 product, including: npm/mermaid:\u003c 8.13.8.

GHSA-p3rp-vmj9-gv6vHighCVSS 7.2

Incorrect sanitisation function leads to `XSS` in mermaid

Vendor

GitHub Security Advisories

Published

January 6, 2022

Last Modified

February 3, 2023

🔗 CVE IDs covered (1)

CVE-2021-43861 →

📋 Description

Impact

Malicious diagrams can contain javascript code that can be run at diagram readers machines.

Patches

The users should upgrade to version 8.13.8

Workarounds

You need to upgrade in order to avoid this issue.

🎯 Affected products1

npm/mermaid:< 8.13.8

🔗 References (5)

https://github.com/mermaid-js/mermaid/security/advisories/GHSA-p3rp-vmj9-gv6v
https://nvd.nist.gov/vuln/detail/CVE-2021-43861
https://github.com/mermaid-js/mermaid/commit/066b7a0d0bda274d94a2f2d21e4323dab5776d83
https://github.com/mermaid-js/mermaid/releases/tag/8.13.8
https://github.com/advisories/GHSA-p3rp-vmj9-gv6v