Skip to content

fix(deps): update dependency mermaid to v11 [security] #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update dependency mermaid to v11 [security] #23

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Oct 22, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
mermaid ^10.2.4 -> ^11.0.0 age confidence

GitHub Vulnerability Alerts

GHSA-m4gq-x24j-jpmf

The following bundled files within the Mermaid NPM package contain a bundled version of DOMPurify that is vulnerable to GHSA-mmhx-hmjr-r674, potentially resulting in an XSS attack.

This affects the built:

  • dist/mermaid.min.js
  • dist/mermaid.js
  • dist/mermaid.esm.mjs
  • dist/mermaid.esm.min.mjs

This will also affect users that use the above files via a CDN link, e.g. https://cdn.jsdelivr.net/npm/[email protected]/dist/mermaid.min.js

Users that use the default NPM export of mermaid, e.g. import mermaid from 'mermaid', or the dist/mermaid.core.mjs file, do not use this bundled version of DOMPurify, and can easily update using their package manager with something like npm audit fix.

Patches

  • develop branch: 6c785c93166c151d27d328ddf68a13d9d65adc00
  • backport to v10: 92a07ffe40aab2769dd1c3431b4eb5beac282b34

CVE-2025-54881

Summary

In the default configuration of mermaid 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS.

Details

Sequence diagram node labels with KaTeX delimiters are passed through calculateMathMLDimensions. This method passes the full label to innerHTML which allows allows malicious users to inject arbitrary HTML and cause XSS when mermaid-js is used in it's default configuration (with KaTeX support enabled).

The vulnerability lies here:

export const calculateMathMLDimensions = async (text: string, config: MermaidConfig) => {
  text = await renderKatex(text, config);
  const divElem = document.createElement('div');
  divElem.innerHTML = text; // XSS sink, text has not been sanitized.
  divElem.id = 'katex-temp';
  divElem.style.visibility = 'hidden';
  divElem.style.position = 'absolute';
  divElem.style.top = '0';
  const body = document.querySelector('body');
  body?.insertAdjacentElement('beforeend', divElem);
  const dim = { width: divElem.clientWidth, height: divElem.clientHeight };
  divElem.remove();
  return dim;
};

The calculateMathMLDimensions method was introduced in 5c69e5fdb004a6d0a2abe97e23d26e223a059832 two years ago, which was released in Mermaid 10.9.0.

PoC

Render the following diagram and observe the modified DOM.

sequenceDiagram
    participant A as Alice<img src="x" onerror="document.write(`xss on ${document.domain}`)">$$\\text{Alice}$$
    A->>John: Hello John, how are you?
    Alice-)John: See you later!

Here is a PoC on mermaid.live: https://mermaid.live/edit#pako:eNpVUMtOwzAQ_BWzyoFKaRTyaFILiio4IK7ckA-1km1iKbaLY6spUf4dJ0AF68uOZ2dm7REqXSNQ6PHDoarwWfDGcMkUudaJGysqceLKkj3hPdl3osJ7IRvSm-qBwcCAaIXGaONRrSsnUdnobITF28PQ954lwXglai25UNNhxWAXBMyXxcGOi-3kL_5k79e73atuFSUv2HWazH1IWn0m3CC5aPf4b3p2WK--BW-4DJCOWzQ3TM0HQmiMqIFa4zAEicZv4iGMsw0D26JEBtS3NR656ywDpiYv869_11r-Ko12TQv0yLveI3eqfcjP111HUNVonrRTFuhdsVgAHWEAmuRxlG7SuEzKMi-yJAnhAjTLIk_EcbFJtuk2y9MphM8lM47KIp--AOZghtU

Impact

XSS on all sites that use mermaid and render user supplied diagrams without further sanitization.

Remediation

The value of the text argument for the calculateMathMLDimensions method needs to be sanitized before getting passed on to innerHTML.

Release Notes

mermaid-js/mermaid (mermaid)

v11.10.0

Compare Source

Minor Changes
Patch Changes

v11.9.0

Compare Source

Minor Changes
  • #​6453 5acbd7e Thanks @​sidharthv96! - feat: Add getRegisteredDiagramsMetadata to mermaid, which returns all the registered diagram IDs in mermaid
Patch Changes

v11.8.1

Compare Source

Patch Changes

v11.8.0

Compare Source

Minor Changes
Patch Changes

v11.7.0

Compare Source

Minor Changes
Patch Changes

v11.6.0

Compare Source

Minor Changes

  • #​6408 ad65313 Thanks @​ashishjain0512! - fix: restore curve type configuration functionality for flowcharts. This fixes the issue where curve type settings were not being applied when configured through any of the following methods:

    • Config
    • Init directive (%%{ init: { 'flowchart': { 'curve': '...' } } }%%)
    • LinkStyle command (linkStyle default interpolate ...)

  • #​6381 95d73bc Thanks @​thomascizeron! - Add Radar Chart

Patch Changes

v11.5.0

Compare Source

Minor Changes

  • #​6187 7809b5a Thanks @​ashishjain0512! - Flowchart new syntax for node metadata bugs

    • Incorrect label mapping for nodes when using &
    • Syntax error when } with trailing spaces before new line

  • #​6136 ec0d9c3 Thanks @​knsv! - Adding support for animation of flowchart edges

  • #​6373 05bdf0e Thanks @​ashishjain0512! - Upgrade Requirement and ER diagram to use the common renderer flow

    • Added support for directions
    • Added support for hand drawn look

  • #​6371 4d25cab Thanks @​knsv! - The arrowhead color should match the color of the edge. Creates a unique clone of the arrow marker with the appropriate color.

Patch Changes

v11.4.1

Compare Source

Patch Changes

  • #​6059 01b5079 Thanks @​knsv! - fix: Kanban diagrams will not render when adding a number as ticket id or assigned for a task

  • #​6038 1388662 Thanks @​knsv! - fix: Intersection calculations for tilted cylinder/DAS when using handdrawn look. Some random seeds could cause the calculations to break.

  • #​6079 fe3cffb Thanks @​aloisklink! - Bump dompurify to ^3.2.1. This removes the need for @types/dompurify.

v11.4.0

Compare Source

Minor Changes

  • #​5999 742ad7c Thanks @​knsv! - Adding Kanban board, a new diagram type

  • #​5880 bdf145f Thanks @​yari-dewalt! - Class diagram changes:

    • Updates the class diagram to the new unified way of rendering.
    • Includes a new "classBox" shape to be used in diagrams
    • Other updates such as:
      • the option to hide the empty members box in class diagrams,
      • support for handDrawn look,
      • the introduction of the classDef statement into class diagrams,
      • support for styling the default class,
      • support lollipop interfaces.
    • Includes fixes / additions for #​5562 #​3139 and #​4037
Patch Changes

v11.3.0

Compare Source

Minor Changes
Patch Changes

  • #​5849 6c5b7ce Thanks @​ReneLombard! - Fixed an issue when the mermaid classdiagram crashes when adding a . to the namespace.
    Forexample

    classDiagram
  namespace Company.Project.Module {
    class GenericClass~T~ {
      +addItem(item: T)
      +getItem() T
    }
  }
    Loading

  • #​5914 de2c05c Thanks @​aloisklink! - Ban DOMPurify v3.1.7 as a dependency

v11.2.1

Compare Source

Patch Changes

v11.2.0

Compare Source

Minor Changes
Patch Changes

v11.1.1

Compare Source

Patch Changes
  • #​5828 4c43d21 Thanks @​knsv! - fix: Fix for issue where self-loops in the root of diagrams break the rendering

v11.1.0

Compare Source

11.1.0

Minor Changes
Patch Changes

v11.0.2

Compare Source

Patch Changes

v11.0.1

Compare Source

Patch Changes

v11.0.0

Compare Source

Release Notes

Major Update

Refactored the Mermaid rendering engine to support new features, including customizable layout algorithms and visual styles. This update enhances diagram flexibility, starting with flowcharts and state diagrams, with plans to extend to all diagram types by @​knsv, @​ashishjain0512, @​sidharthv96 in https://github.com/mermaid-js/mermaid/pull/5604

🚨 Breaking Changes

🚀 Features

🐛 Bug Fixes

🧰 Maintenance

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from slugb0t as a code owner October 22, 2024 18:56
@vercel
Copy link

vercel bot commented Oct 22, 2024 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
codefair-docs Ready Ready Preview Comment Aug 19, 2025 10:29pm

@sourcery-ai
Copy link
Contributor

sourcery-ai bot commented Oct 22, 2024 •
edited
Loading

🧙 Sourcery has finished reviewing your pull request!

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time. You can also use
    this command to specify where the summary should be inserted.

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

sourcery-ai[bot]
sourcery-ai bot reviewed Oct 22, 2024
View reviewed changes
Copy link
Contributor

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have skipped reviewing this pull request. It seems to have been created by a bot (hey, renovate[bot]!). We assume it knows what it's doing!

@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 8271f2b to be997d8 Compare January 23, 2025 21:43
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from be997d8 to bd3477c Compare February 9, 2025 13:11
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from bd3477c to 6cc11a4 Compare March 3, 2025 15:06
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 6cc11a4 to 36b4b0a Compare March 11, 2025 10:21
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 36b4b0a to 7a5c077 Compare April 8, 2025 12:36
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 7a5c077 to f8d3cd0 Compare April 24, 2025 08:30
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from f8d3cd0 to ae11728 Compare May 19, 2025 16:45
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from ae11728 to b6ffd89 Compare June 22, 2025 12:27
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from b6ffd89 to 6a204ad Compare August 10, 2025 12:47
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 6a204ad to 66bf5df Compare August 13, 2025 15:41
@renovate renovate bot changed the title fix(deps): update dependency mermaid to v10.9.3 [security] fix(deps): update dependency mermaid to v11 [security] Aug 19, 2025
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 66bf5df to a31f6ff Compare August 19, 2025 22:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sourcery-ai sourcery-ai[bot] sourcery-ai[bot] left review comments

@slugb0t slugb0t Awaiting requested review from slugb0t slugb0t is a code owner

Assignees

No one assigned

Labels

type: dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants