En resumen
- CVE-2021-43861 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a mermaid (mermaid project), mermaid.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.94%, mayor que el 61.0% de las vulnerabilidades.
- Solución: actualizar a 8.13.8 o posterior.
| Package | Affected versions | Patched versions |
|---|
| mermaid | < 8.13.8
| 8.13.8
|
| mermaid npm | < 8.13.8
| 8.13.8
|
Description
Impact
Malicious diagrams can contain javascript code that can be run at diagram readers machines.
Patches
The users should upgrade to version 8.13.8
Workarounds
You need to upgrade in order to avoid this issue.
NVD description
Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 to receive a patch. There are no known workarounds aside from upgrading.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free