Source: node-mermaid Version: 9.2.2+~2.0.0-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for node-mermaid. node-mermaid recently got reintroduced in Debian unstable, and I think the current list is the remianing open ones, can you double-check please? CVE-2026-41148[0]: | Mermaid is a JavaScript tool that uses Markdown-inspired text to | create and modify diagrams and charts. Versions 10.9.5 and prior, in | addition to 11.0.0-alpha.1 through 11.12.0 are vulnerable to CSS | injection through improper sanitization. The state diagram (and any | other diagram type that routes user-controlled style strings through | the createCssStyles parser) captures classDef values using an | unrestricted regex that matches everything up to a newline. That | value then flows unsanitized through addStyleClass() into | createCssStyles() and is assigned to style.innerHTML, so a closing | brace (}) in the value terminates the generated CSS selector and | turns everything after it into a new CSS rule on the page. This | enables page defacement, user tracking via url() callbacks, and DOM | attribute exfiltration. This issue has been fixed in versions 10.9.6 | and 11.15.0. If developers are unable to immediately upgrade, they | can work around this issue by setting "securityLevel": "sandbox", | which prevents the issue by rendering the mermaid diagram in a | sandboxed <iframe>. CVE-2026-41149[1]: | Mermaid is a JavaScript tool that uses Markdown-inspired text to | create and modify diagrams and charts. Versions 10.9.5 and earlier, | as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML | injection under the default configuration. Specifically, the | classDef directive in Mermaid state diagrams permits DOM injection | that escapes the SVG context. However, <script> tags are stripped, | which prevents cross-site scripting (XSS). This issue has been fixed | in versions 10.9.6 and 11.15.0. If developers are unable to | immediately upgrade, they can work around this issue by setting | "securityLevel": "sandbox", which prevents the issue by rendering | the mermaid diagram in a sandboxed <iframe>. CVE-2026-41150[2]: | Mermaid is a JavaScript tool that uses Markdown-inspired text to | create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, | there is a denial-of-service attack when rendering gantt charts, if | they use the excludes attribute to exclude all dates. mermaid.parse | is unaffected, unless you then call the ganttDb.getTasks() (which is | called when rendering a diagram). This vulnerability is fixed in | 10.9.6 and 11.15.0. CVE-2026-41159[3]: | Mermaid is a JavaScript tool that uses Markdown-inspired text to | create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, | Mermaid's default configuration allows injecting CSS that applies | outside of the Mermaid diagram via the fontFamily, themeCSS, and | altFontFamily configuration options. The injected CSS exploits | stylis's & (scope reference) handling. :not(&) escapes the #mermaid- | xxx automatic scoping, applying styles to all page elements. Global | at-rules (@font-face, @keyframes, @counter-style) are also | injectable as stylis hoists them to top level. This allows page | defacement and DOM attribute exfiltration via CSS :has() selectors. | This vulnerability is fixed in 10.9.6 and 11.15.0. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-41148 https://www.cve.org/CVERecord?id=CVE-2026-41148 [1] https://security-tracker.debian.org/tracker/CVE-2026-41149 https://www.cve.org/CVERecord?id=CVE-2026-41149 [2] https://security-tracker.debian.org/tracker/CVE-2026-41150 https://www.cve.org/CVERecord?id=CVE-2026-41150 [3] https://security-tracker.debian.org/tracker/CVE-2026-41159 https://www.cve.org/CVERecord?id=CVE-2026-41159 Regards, Salvatore
