GHSA-m4gq-x24j-jpmf

Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify

High npm

Severity: 7.0 / 10; High · CVSS 3.1
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'); CWE-1395 Dependency on Vulnerable Third-Party Component
Fix: 10.9.3; Upgrade mermaid to this version or later

Description

The following bundled files within the Mermaid NPM package contain a bundled version of DOMPurify that is vulnerable to https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674, potentially resulting in an XSS attack.

This affects the built:

dist/mermaid.min.js
dist/mermaid.js
dist/mermaid.esm.mjs
dist/mermaid.esm.min.mjs

This will also affect users that use the above files via a CDN link, e.g. https://cdn.jsdelivr.net/npm/mermaid@10.9.2/dist/mermaid.min.js

Users that use the default NPM export of mermaid, e.g. import mermaid from 'mermaid', or the dist/mermaid.core.mjs file, do not use this bundled version of DOMPurify, and can easily update using their package manager with something like npm audit fix.

Patches

develop branch: 6c785c93166c151d27d328ddf68a13d9d65adc00
backport to v10: 92a07ffe40aab2769dd1c3431b4eb5beac282b34

Affected versions

npm

Package	Vulnerable	Fixed in
mermaid	`< 10.9.3`	`10.9.3`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

mermaid npm → `10.9.3`

npm

npm install mermaid@10.9.3

yarn

yarn add mermaid@10.9.3

pnpm

pnpm add mermaid@10.9.3

Severity breakdown

CVSS 3.1 7.0

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: High
Availability: Low

Weakness

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

How to prevent it

Implementation: By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Architecture and Design: By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Implementation: When handling untrusted objects, validating using a schema can be used.
Implementation: By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Implementation: Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

CWE-1395: Dependency on Vulnerable Third-Party Component

The product has a dependency on a third-party component that contains one or more known vulnerabilities.

How to prevent it

Requirements, Policy: In some industries such as healthcare [REF-1320] [REF-1322] or technologies such as the cloud [REF-1321], it might be unclear about who is responsible for applying patches for third-party vulnerabilities: the vendor, the operator/customer, or a separate service. Clarifying roles and responsibilities can be important to minimize confusion or unnecessary delay when third-party vulnerabilities are disclosed.
Requirements: Require a Bill of Materials for all components and sub-components of the product. For software, require a Software Bill of Materials (SBOM) [REF-1247] [REF-1311].
Architecture and Design, Implementation, Integration, Manufacturing: Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships."
Operation, Patching and Maintenance: Actively monitor when a third-party component vendor announces vulnerability patches; fix the third-party component as soon as possible; and make it easy for operators/customers to obtain and apply the patch.
Operation, Patching and Maintenance: Continuously monitor changes in each of the product's components, especially when the changes indicate new vulnerabilities, end-of-life (EOL) plans, etc.

References

Packages

github.com/mermaid-js/mermaid

Timeline

Oct 22, 2024 Published
Oct 23, 2024 Last updated by the source

Advisory	Severity	Why it's related
GHSA-rhh3-jpg6-66xh Mermaid radar diagrams are vulnerable to DoS	Medium	Also affects mermaid
GHSA-c4c3-pg64-4m4v Mermaid configuration APIs allow prototype pollution	Low	Also affects mermaid
GHSA-6x64-9x62-f2gx Mermaid allows CSS injection applying to sibling elements of the diagram	Medium	Also affects mermaid
GHSA-3rrr-jr9j-h3q3 Mermaid Architecture diagrams are vulnerable to prototype pollution	Medium	Also affects mermaid
GHSA-2v8p-3f2j-5mp7 Mermaid XY Charts are vulnerable to an infinite loop DoS	Medium	Also affects mermaid
GHSA-87f9-hvmw-gh4p Mermaid: Improper sanitization of configuration leads to CSS injection	Medium	Also affects mermaid
GHSA-6m6c-36f7-fhxh Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS	Medium	Also affects mermaid
GHSA-ghcm-xqfw-q4vr Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection	Medium	Also affects mermaid

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor