Mermaid JavaScript Library KaTeX Label Handling Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the Mermaid JavaScript library, specifically in versions 10.9.0-rc.1 through 11.9.0. The issue arises in the default configuration when user-supplied input for sequence diagram labels is processed. The input is passed to 'innerHTML' without proper sanitization, allowing for the injection of malicious HTML that can be executed in the user's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting (XSS) attacks, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, create a sequence diagram in Mermaid using a label that includes KaTeX delimiters and a crafted image tag (e.g., an image with an 'onerror' attribute). When the diagram is rendered, the injected script will execute, demonstrating the XSS vulnerability.

Remediation

Users can update to Mermaid version 11.10.0 or later, where this vulnerability has been addressed.