{"action":"Upgrade mermaid to 10.9.3 or later.","affected":[{"fixed":"10.9.3","introduced":"0"}],"component":"mermaid","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["10.9.3"],"ghsa_id":"GHSA-m4gq-x24j-jpmf","id":"tcs_01M5KFZHYEBT4XFN9SMQYG0VN0","modified_at":"2024-10-23T14:24:24Z","published_at":"2024-10-22T18:17:02Z","references":["https://osv.dev/vulnerability/GHSA-m4gq-x24j-jpmf","https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674","https://github.com/mermaid-js/mermaid/security/advisories/GHSA-m4gq-x24j-jpmf","https://github.com/mermaid-js/mermaid/commit/6c785c93166c151d27d328ddf68a13d9d65adc00","https://github.com/mermaid-js/mermaid/commit/92a07ffe40aab2769dd1c3431b4eb5beac282b34","https://github.com/mermaid-js/mermaid"],"severity":{"label":"high","score":7},"sources":[{"source":"osv","source_id":"GHSA-m4gq-x24j-jpmf","url":"https://osv.dev/vulnerability/GHSA-m4gq-x24j-jpmf"}],"summary":"Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify"}