CVE-2022-31108

npm/mermaid CVE-2022-31108: medium 4.1, EPSS 0.91%

Possible inject arbitrary `CSS` into the generated graph affecting the container HTML

Action: Upgrade mermaid to 9.1.2 or later.

npm i mermaid@9.1.2

Affected

Fixed versions

Sources

• osv: GHSA-x3vm-38hw-55wf
• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-x3vm-38hw-55wf
• https://nvd.nist.gov/vuln/detail/CVE-2022-31108
• https://github.com/mermaid-js/mermaid/commit/0ae1bdb61adff1cd485caff8c62ec6b8ac57b225
• https://github.com/mermaid-js/mermaid

CVE-2022-31108 · published 2022-07-05T18:29:31Z · modified 2023-11-08T04:09:26.448142Z · JSON