| Package | Affected versions | Patched versions |
|---|---|---|
| mermaid | ≥ 11.0.0, < 11.15.0< 10.9.6 | 11.15.010.9.6 |
| mermaid | ≥ 11.0.0-alpha.1, < 11.15.0< 10.9.6 | 11.15.010.9.6 |
Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates.
Example:
gantt
excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday
DoS :2025-01-01, 1d
mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram).
This has been patched in:
There are no workarounds available without updating to a newer version of mermaid.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free