NodeJS/mermaid/7.1.2


Markdown-ish syntax for generating flowcharts, sequence diagrams, class diagrams, gantt charts and git graphs.

https://www.npmjs.com/package/mermaid
MIT

3 Security Vulnerabilities

Cross-site Scripting in Mermaid

Published date: 2021-12-10T18:57:41Z
CVE: CVE-2021-35513
Links:

Mermaid before 8.11.0 allows XSS when the antiscript feature is used.

Affected versions: ["0.2.11", "0.2.12", "0.2.13", "0.2.14", "0.2.15", "0.2.16", "0.3.0", "0.3.2", "0.3.3", "0.3.4", "0.3.5", "0.4.0", "0.5.0", "0.5.1", "0.5.2", "0.5.3", "0.5.4", "0.5.5", "0.5.6", "0.5.7", "0.5.8", "6.0.0", "7.0.0", "7.0.1", "7.0.2", "7.0.3", "7.0.4", "7.0.5", "7.0.6", "7.0.7", "7.0.8", "7.0.9", "7.0.10", "7.0.11", "7.0.12", "7.0.13", "7.0.14", "7.0.15", "7.0.16", "7.0.17", "7.0.18", "7.1.0", "7.1.1", "7.1.2", "8.0.0-alpha.1", "8.0.0-alpha.2", "8.0.0-alpha.3", "8.0.0-alpha.4", "8.0.0-alpha.5", "8.0.0-alpha.6", "8.0.0-alpha.8", "8.0.0-alpha.9", "8.0.0-beta.1", "8.0.0-beta.2", "8.0.0-beta.3", "8.0.0-beta.4", "8.0.0-beta.5", "8.0.0-beta.6", "8.0.0-beta.7", "8.0.0-beta.8", "8.0.0-beta.9", "8.0.0-rc.1", "8.0.0-rc.2", "8.0.0-rc.3", "8.0.0-rc.4", "8.0.0-rc.5", "8.0.0-rc.6", "8.0.0-rc.7", "8.0.0-rc.8", "8.0.0", "8.1.0", "8.2.1", "8.2.2", "8.2.3", "8.2.4", "8.2.5", "8.2.6", "8.3.0", "8.3.1", "8.4.0", "8.4.1", "8.4.2", "8.4.3", "8.4.4", "8.4.5", "8.4.6", "8.4.7", "8.4.8", "8.5.0", "8.5.1", "8.5.2", "8.6.0", "8.6.1", "8.6.2", "8.6.3", "8.6.4", "8.7.0", "8.8.0", "8.8.1", "8.8.2", "8.8.3", "8.8.4", "8.9.0", "8.9.1", "8.9.2", "8.9.3", "8.10.1", "8.10.2"]
Secure versions: [9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0-rc1, 9.1.7, 9.2.0-rc2, 9.2.0-rc3, 9.2.0-rc4, 9.2.0-rc5, 9.2.0-rc6, 9.2.0-rc7, 9.2.0-rc8, 9.2.0-rc9, 9.2.0-rc10, 9.2.0, 9.2.1, 9.2.2-rc.2, 9.2.2, 9.2.3-rc.1, 9.3.0-rc.1, 9.3.0-rc.2, 9.3.0-rc.3, 9.3.0-rc.4, 9.3.0-rc.5, 9.3.0-rc.6, 9.3.0-rc.7, 9.3.0, 9.4.0-rc.1, 9.4.0-rc.2, 9.4.0, 9.4.2-rc.1, 10.0.0-rc.1, 10.0.0-rc.2, 10.0.0-rc.3, 10.0.0-rc.4, 10.0.0, 10.0.1-rc.1, 10.0.1-rc.2, 10.0.1-rc.3, 9.4.2-rc.2, 10.0.1-rc.4, 10.0.1-rc.5, 10.0.1, 10.0.2-rc.1, 10.0.2, 10.0.3-alpha.1, 9.4.2, 9.4.3, 10.1.0-rc.1, 10.1.0, 10.2.0-rc.1, 10.2.0-rc.2, 10.2.0-rc.3, 10.2.0-rc.4, 10.2.0, 10.2.1-rc.1, 10.2.1, 10.2.2, 10.2.3-rc.1, 10.2.3, 10.2.4-rc.1, 10.2.4, 10.3.0-rc.1, 10.3.0, 10.3.1, 11.0.0-alpha.1, 11.0.0-alpha.2, 11.0.0-alpha.3, 11.0.0-alpha.4, 10.4.0, 10.5.0-alpha.1, 10.5.0-rc.1, 10.5.0-rc.3, 10.5.0, 10.5.1, 10.6.0, 10.6.1, 11.0.0-alpha.5, 10.6.2-rc.1, 11.0.0-alpha.6, 10.6.2-rc.2, 10.6.2-rc.3, 10.7.0, 10.8.0, 10.9.0-rc.1, 10.9.0-rc.2, 10.9.0, 11.0.0-alpha.7]
Recommendation: Update to version 10.9.0.

Incorrect sanitisation function leads to `XSS` in mermaid

Published date: 2022-01-06T19:45:59Z
CVE: CVE-2021-43861
Links:

Impact

Malicious diagrams can contain javascript code that can be run at diagram readers machines.

Patches

The users should upgrade to version 8.13.8

Workarounds

You need to upgrade in order to avoid this issue.

Affected versions: ["0.2.11", "0.2.12", "0.2.13", "0.2.14", "0.2.15", "0.2.16", "0.3.0", "0.3.2", "0.3.3", "0.3.4", "0.3.5", "0.4.0", "0.5.0", "0.5.1", "0.5.2", "0.5.3", "0.5.4", "0.5.5", "0.5.6", "0.5.7", "0.5.8", "6.0.0", "7.0.0", "7.0.1", "7.0.2", "7.0.3", "7.0.4", "7.0.5", "7.0.6", "7.0.7", "7.0.8", "7.0.9", "7.0.10", "7.0.11", "7.0.12", "7.0.13", "7.0.14", "7.0.15", "7.0.16", "7.0.17", "7.0.18", "7.1.0", "7.1.1", "7.1.2", "8.0.0-alpha.1", "8.0.0-alpha.2", "8.0.0-alpha.3", "8.0.0-alpha.4", "8.0.0-alpha.5", "8.0.0-alpha.6", "8.0.0-alpha.8", "8.0.0-alpha.9", "8.0.0-beta.1", "8.0.0-beta.2", "8.0.0-beta.3", "8.0.0-beta.4", "8.0.0-beta.5", "8.0.0-beta.6", "8.0.0-beta.7", "8.0.0-beta.8", "8.0.0-beta.9", "8.0.0-rc.1", "8.0.0-rc.2", "8.0.0-rc.3", "8.0.0-rc.4", "8.0.0-rc.5", "8.0.0-rc.6", "8.0.0-rc.7", "8.0.0-rc.8", "8.0.0", "8.1.0", "8.2.1", "8.2.2", "8.2.3", "8.2.4", "8.2.5", "8.2.6", "8.3.0", "8.3.1", "8.4.0", "8.4.1", "8.4.2", "8.4.3", "8.4.4", "8.4.5", "8.4.6", "8.4.7", "8.4.8", "8.5.0", "8.5.1", "8.5.2", "8.6.0", "8.6.1", "8.6.2", "8.6.3", "8.6.4", "8.7.0", "8.8.0", "8.8.1", "8.8.2", "8.8.3", "8.8.4", "8.9.0", "8.9.1", "8.9.2", "8.9.3", "8.10.1", "8.10.2", "8.11.0", "8.11.1", "8.11.2", "8.11.3", "8.11.4", "8.11.5", "8.12.0", "8.12.1", "8.13.0", "8.13.1", "8.13.2", "8.13.3", "8.13.4", "8.13.5", "8.13.6", "8.13.7"]
Secure versions: [9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0-rc1, 9.1.7, 9.2.0-rc2, 9.2.0-rc3, 9.2.0-rc4, 9.2.0-rc5, 9.2.0-rc6, 9.2.0-rc7, 9.2.0-rc8, 9.2.0-rc9, 9.2.0-rc10, 9.2.0, 9.2.1, 9.2.2-rc.2, 9.2.2, 9.2.3-rc.1, 9.3.0-rc.1, 9.3.0-rc.2, 9.3.0-rc.3, 9.3.0-rc.4, 9.3.0-rc.5, 9.3.0-rc.6, 9.3.0-rc.7, 9.3.0, 9.4.0-rc.1, 9.4.0-rc.2, 9.4.0, 9.4.2-rc.1, 10.0.0-rc.1, 10.0.0-rc.2, 10.0.0-rc.3, 10.0.0-rc.4, 10.0.0, 10.0.1-rc.1, 10.0.1-rc.2, 10.0.1-rc.3, 9.4.2-rc.2, 10.0.1-rc.4, 10.0.1-rc.5, 10.0.1, 10.0.2-rc.1, 10.0.2, 10.0.3-alpha.1, 9.4.2, 9.4.3, 10.1.0-rc.1, 10.1.0, 10.2.0-rc.1, 10.2.0-rc.2, 10.2.0-rc.3, 10.2.0-rc.4, 10.2.0, 10.2.1-rc.1, 10.2.1, 10.2.2, 10.2.3-rc.1, 10.2.3, 10.2.4-rc.1, 10.2.4, 10.3.0-rc.1, 10.3.0, 10.3.1, 11.0.0-alpha.1, 11.0.0-alpha.2, 11.0.0-alpha.3, 11.0.0-alpha.4, 10.4.0, 10.5.0-alpha.1, 10.5.0-rc.1, 10.5.0-rc.3, 10.5.0, 10.5.1, 10.6.0, 10.6.1, 11.0.0-alpha.5, 10.6.2-rc.1, 11.0.0-alpha.6, 10.6.2-rc.2, 10.6.2-rc.3, 10.7.0, 10.8.0, 10.9.0-rc.1, 10.9.0-rc.2, 10.9.0, 11.0.0-alpha.7]
Recommendation: Update to version 10.9.0.

Cross-Site Scripting in mermaid

Published date: 2020-09-02T15:41:41Z
Links:

Versions of mermaid prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input such as A["<img src=invalid onerror=alert('XSS')></img>"] is provided to the application, it will execute the code instead of rendering it as text due to improper output encoding.

Recommendation

Upgrade to version 8.2.3 or later

Affected versions: ["0.2.11", "0.2.12", "0.2.13", "0.2.14", "0.2.15", "0.2.16", "0.3.0", "0.3.2", "0.3.3", "0.3.4", "0.3.5", "0.4.0", "0.5.0", "0.5.1", "0.5.2", "0.5.3", "0.5.4", "0.5.5", "0.5.6", "0.5.7", "0.5.8", "6.0.0", "7.0.0", "7.0.1", "7.0.2", "7.0.3", "7.0.4", "7.0.5", "7.0.6", "7.0.7", "7.0.8", "7.0.9", "7.0.10", "7.0.11", "7.0.12", "7.0.13", "7.0.14", "7.0.15", "7.0.16", "7.0.17", "7.0.18", "7.1.0", "7.1.1", "7.1.2", "8.0.0-alpha.1", "8.0.0-alpha.2", "8.0.0-alpha.3", "8.0.0-alpha.4", "8.0.0-alpha.5", "8.0.0-alpha.6", "8.0.0-alpha.8", "8.0.0-alpha.9", "8.0.0-beta.1", "8.0.0-beta.2", "8.0.0-beta.3", "8.0.0-beta.4", "8.0.0-beta.5", "8.0.0-beta.6", "8.0.0-beta.7", "8.0.0-beta.8", "8.0.0-beta.9", "8.0.0-rc.1", "8.0.0-rc.2", "8.0.0-rc.3", "8.0.0-rc.4", "8.0.0-rc.5", "8.0.0-rc.6", "8.0.0-rc.7", "8.0.0-rc.8", "8.0.0", "8.1.0", "8.2.1", "8.2.2"]
Secure versions: [9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0-rc1, 9.1.7, 9.2.0-rc2, 9.2.0-rc3, 9.2.0-rc4, 9.2.0-rc5, 9.2.0-rc6, 9.2.0-rc7, 9.2.0-rc8, 9.2.0-rc9, 9.2.0-rc10, 9.2.0, 9.2.1, 9.2.2-rc.2, 9.2.2, 9.2.3-rc.1, 9.3.0-rc.1, 9.3.0-rc.2, 9.3.0-rc.3, 9.3.0-rc.4, 9.3.0-rc.5, 9.3.0-rc.6, 9.3.0-rc.7, 9.3.0, 9.4.0-rc.1, 9.4.0-rc.2, 9.4.0, 9.4.2-rc.1, 10.0.0-rc.1, 10.0.0-rc.2, 10.0.0-rc.3, 10.0.0-rc.4, 10.0.0, 10.0.1-rc.1, 10.0.1-rc.2, 10.0.1-rc.3, 9.4.2-rc.2, 10.0.1-rc.4, 10.0.1-rc.5, 10.0.1, 10.0.2-rc.1, 10.0.2, 10.0.3-alpha.1, 9.4.2, 9.4.3, 10.1.0-rc.1, 10.1.0, 10.2.0-rc.1, 10.2.0-rc.2, 10.2.0-rc.3, 10.2.0-rc.4, 10.2.0, 10.2.1-rc.1, 10.2.1, 10.2.2, 10.2.3-rc.1, 10.2.3, 10.2.4-rc.1, 10.2.4, 10.3.0-rc.1, 10.3.0, 10.3.1, 11.0.0-alpha.1, 11.0.0-alpha.2, 11.0.0-alpha.3, 11.0.0-alpha.4, 10.4.0, 10.5.0-alpha.1, 10.5.0-rc.1, 10.5.0-rc.3, 10.5.0, 10.5.1, 10.6.0, 10.6.1, 11.0.0-alpha.5, 10.6.2-rc.1, 11.0.0-alpha.6, 10.6.2-rc.2, 10.6.2-rc.3, 10.7.0, 10.8.0, 10.9.0-rc.1, 10.9.0-rc.2, 10.9.0, 11.0.0-alpha.7]
Recommendation: Update to version 10.9.0.

223 Other Versions

Version License Security Released
0.3.3 MIT 3 2015-01-25 - 15:46 over 9 years
0.5.2 MIT 3 2015-10-04 - 21:09 over 8 years
7.0.2 MIT 3 2017-06-01 - 05:42 almost 7 years
7.0.18 MIT 3 2017-09-13 - 02:14 over 6 years
8.0.0-rc.6 MIT 3 2018-03-21 - 13:30 about 6 years
0.2.16 MIT 3 2014-12-15 - 18:44 over 9 years
0.3.0 MIT 3 2014-12-22 - 12:55 over 9 years
0.3.2 MIT 3 2015-01-11 - 14:13 over 9 years
8.11.0 MIT 2 2021-06-27 - 05:53 almost 3 years
0.3.4 MIT 3 2015-02-15 - 17:16 about 9 years
0.3.5 MIT 3 2015-02-15 - 18:38 about 9 years
0.4.0 MIT 3 2015-03-01 - 15:52 about 9 years
0.5.0 MIT 3 2015-06-07 - 15:06 almost 9 years
0.5.1 MIT 3 2015-06-21 - 15:27 almost 9 years
10.0.1-rc.5 MIT 2023-03-01 - 12:55 about 1 year
0.5.3 MIT 3 2015-10-04 - 21:29 over 8 years
0.5.4 MIT 3 2015-10-19 - 20:09 over 8 years
0.5.5 MIT 3 2015-10-21 - 19:15 over 8 years
0.5.6 MIT 3 2015-11-22 - 18:09 over 8 years
0.5.7 MIT 3 2016-01-25 - 18:12 over 8 years
0.5.8 MIT 3 2016-01-27 - 14:06 over 8 years
6.0.0 MIT 3 2016-05-29 - 17:27 almost 8 years
7.0.0 MIT 3 2017-01-29 - 11:15 over 7 years
7.0.1 MIT 3 2017-06-01 - 05:13 almost 7 years
10.7.0 MIT 2024-01-15 - 09:02 4 months
7.0.3 MIT 3 2017-06-04 - 04:19 almost 7 years
7.0.4 MIT 3 2017-08-16 - 16:03 over 6 years
7.0.5 MIT 3 2017-09-01 - 10:39 over 6 years
7.0.6 MIT 3 2017-09-01 - 13:41 over 6 years
7.0.7 MIT 3 2017-09-02 - 15:43 over 6 years
7.0.8 MIT 3 2017-09-03 - 14:18 over 6 years
7.0.9 MIT 3 2017-09-06 - 03:15 over 6 years
7.0.10 MIT 3 2017-09-08 - 16:58 over 6 years
7.0.11 MIT 3 2017-09-09 - 13:49 over 6 years
7.0.12 MIT 3 2017-09-10 - 14:58 over 6 years
7.0.13 MIT 3 2017-09-10 - 15:15 over 6 years
7.0.14 MIT 3 2017-09-11 - 15:03 over 6 years
7.0.15 MIT 3 2017-09-12 - 14:16 over 6 years
7.0.16 MIT 3 2017-09-12 - 14:51 over 6 years
7.0.17 MIT 3 2017-09-12 - 15:14 over 6 years
11.0.0-alpha.7 MIT 2024-03-23 - 13:27 about 1 month
7.1.0 MIT 3 2017-09-14 - 03:26 over 6 years
7.1.1 MIT 3 2017-12-20 - 14:20 over 6 years
7.1.2 MIT 3 2017-12-26 - 13:00 over 6 years
8.0.0-alpha.1 MIT 3 2018-03-09 - 01:36 about 6 years
8.0.0-alpha.2 MIT 3 2018-03-11 - 15:28 about 6 years
8.0.0-alpha.3 MIT 3 2018-03-11 - 15:49 about 6 years
8.0.0-alpha.4 MIT 3 2018-03-12 - 13:35 about 6 years
8.0.0-alpha.5 MIT 3 2018-03-13 - 05:25 about 6 years
8.0.0-alpha.6 MIT 3 2018-03-13 - 11:32 about 6 years
8.0.0-alpha.8 MIT 3 2018-03-13 - 14:57 about 6 years
8.0.0-alpha.9 MIT 3 2018-03-14 - 13:41 about 6 years
8.0.0-beta.1 MIT 3 2018-03-15 - 13:49 about 6 years
8.0.0-beta.2 MIT 3 2018-03-15 - 14:45 about 6 years
8.0.0-beta.3 MIT 3 2018-03-16 - 12:17 about 6 years
8.0.0-beta.4 MIT 3 2018-03-16 - 12:28 about 6 years
8.0.0-beta.5 MIT 3 2018-03-17 - 01:11 about 6 years
8.0.0-beta.6 MIT 3 2018-03-17 - 10:13 about 6 years
8.0.0-beta.7 MIT 3 2018-03-17 - 15:20 about 6 years
8.0.0-beta.8 MIT 3 2018-03-18 - 01:09 about 6 years
8.0.0-beta.9 MIT 3 2018-03-18 - 01:36 about 6 years
8.0.0-rc.1 MIT 3 2018-03-19 - 01:32 about 6 years
8.0.0-rc.2 MIT 3 2018-03-20 - 12:10 about 6 years
8.0.0-rc.3 MIT 3 2018-03-20 - 12:42 about 6 years
8.0.0-rc.4 MIT 3 2018-03-20 - 13:51 about 6 years
8.0.0-rc.5 MIT 3 2018-03-20 - 15:05 about 6 years
10.9.0-rc.2 MIT 2024-02-29 - 03:14 2 months
8.0.0-rc.7 MIT 3 2018-04-12 - 01:07 about 6 years
8.0.0-rc.8 MIT 3 2018-04-12 - 15:06 about 6 years
8.0.0 MIT 4 2018-12-18 - 06:56 over 5 years
8.1.0 MIT 4 2019-06-25 - 08:39 almost 5 years
8.2.1 MIT 4 2019-07-21 - 09:34 almost 5 years
8.2.2 MIT 4 2019-07-21 - 14:41 almost 5 years
8.2.3 MIT 3 2019-07-22 - 12:25 almost 5 years
8.2.4 MIT 3 2019-08-25 - 13:32 over 4 years
8.2.5 MIT 3 2019-08-26 - 18:25 over 4 years
8.2.6 MIT 3 2019-09-01 - 11:18 over 4 years
8.3.0 MIT 3 2019-09-19 - 05:33 over 4 years
8.3.1 MIT 3 2019-09-19 - 22:10 over 4 years
8.4.0 MIT 3 2019-10-19 - 14:48 over 4 years
8.4.1 MIT 3 2019-11-06 - 18:42 over 4 years
8.4.2 MIT 3 2019-11-07 - 20:39 over 4 years
8.4.3 MIT 3 2019-12-01 - 06:47 over 4 years
8.4.4 MIT 3 2019-12-14 - 08:22 over 4 years
8.4.5 MIT 3 2020-01-11 - 09:03 over 4 years
8.4.6 MIT 3 2020-01-22 - 18:21 over 4 years
8.4.7 MIT 3 2020-02-16 - 13:00 about 4 years
8.4.8 MIT 3 2020-02-21 - 09:42 about 4 years
8.5.0 MIT 3 2020-04-11 - 15:46 about 4 years
8.5.1 MIT 3 2020-05-17 - 08:02 almost 4 years
8.5.2 MIT 3 2020-06-07 - 08:52 almost 4 years
8.6.0 MIT 3 2020-07-13 - 14:39 almost 4 years
8.6.1 MIT 3 2020-07-22 - 16:53 almost 4 years
8.6.2 MIT 3 2020-07-22 - 17:16 almost 4 years
8.6.3 MIT 3 2020-07-24 - 11:17 almost 4 years
8.6.4 MIT 3 2020-07-26 - 20:25 almost 4 years
8.7.0 MIT 3 2020-08-09 - 12:00 over 3 years
8.8.0 MIT 3 2020-09-05 - 07:45 over 3 years
8.8.1 MIT 3 2020-09-30 - 17:22 over 3 years
8.8.2 MIT 3 2020-10-08 - 17:34 over 3 years