CVE-2021-43861CWE-20CWE-79

Incorrect sanitisation function leads to `XSS`

High · published December 30, 2021

CVSS v3.1
7.2
EPSS
1%
Percentile
59.5
In the wild
Unconfirmed
What it is

Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 to receive a patch. There are no known workarounds aside from upgrading.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00908 · 59.5th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-12-30T13:40Z
EPSS history
Timeline
  • 30 DEC 13:40Z
    Incorrect sanitisation function leads to `XSS`
    cvelistv5