{"action":"Upgrade mermaid to 8.13.8 or later.","affected":[{"fixed":"8.13.8","introduced":"0"}],"component":"mermaid","cve_ids":["CVE-2021-43861"],"ecosystem":"npm","epss":0.00938,"exploited":false,"fixed_versions":["8.13.8"],"ghsa_id":"GHSA-p3rp-vmj9-gv6v","id":"tcs_01M5KG2DKZ4NVFNAAYC3WVB961","modified_at":"2026-07-08T06:28:14.087175466Z","published_at":"2022-01-06T19:45:59Z","references":["https://osv.dev/vulnerability/GHSA-p3rp-vmj9-gv6v","https://github.com/mermaid-js/mermaid/security/advisories/GHSA-p3rp-vmj9-gv6v","https://nvd.nist.gov/vuln/detail/CVE-2021-43861","https://github.com/mermaid-js/mermaid/commit/066b7a0d0bda274d94a2f2d21e4323dab5776d83","https://github.com/mermaid-js/mermaid","https://github.com/mermaid-js/mermaid/releases/tag/8.13.8"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-p3rp-vmj9-gv6v","url":"https://osv.dev/vulnerability/GHSA-p3rp-vmj9-gv6v"}],"summary":"Incorrect sanitisation function leads to `XSS` in mermaid"}