npm/@excalidraw/mermaid-to-excalidraw: medium
Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)
Action: Upgrade @excalidraw/mermaid-to-excalidraw to 1.1.3 or later.
npm i @excalidraw/mermaid-to-excalidraw@1.1.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.3.0 | 1.1.3 | - |
Fixed versions
| 1.1.3 |
Sources
- osv: GHSA-39h7-pwv7-rc3x#npm/@excalidraw/mermaid-to-excalidraw
- https://github.com/excalidraw/excalidraw/security/advisories/GHSA-39h7-pwv7-rc3x
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh
- https://github.com/excalidraw/excalidraw
- https://github.com/excalidraw/excalidraw/releases/tag/v0.18.1
published · modified · JSON