Mermaid npm Package Vulnerability: Prototype Pollution in Architecture Diagrams
An early warning has been issued regarding a vulnerability in the Mermaid npm package, specifically versions 11.5.0 to 11.16.0, which reportedly allows for prototype pollution when rendering untrusted architecture-beta diagrams. This vulnerability, tracked as GHSA-3RRR-JR9J-H3Q3, may lead to corrupted config defaults, bypassed truthiness checks, and logic corruption in the embedding application.
What happened
The Mermaid npm package, utilized for generating diagrams and visualizations, appears to be vulnerable to prototype pollution. This vulnerability, which affects versions 11.5.0 through 11.16.0, is under investigation for its potential to corrupt configuration defaults, bypass truthiness checks, and introduce logic errors within applications that embed Mermaid diagrams. The issue arises specifically when rendering untrusted architecture-beta diagrams, suggesting that applications processing user-generated or untrusted input through Mermaid may be at risk.
To assess your exposure, review your application's use of Mermaid, particularly focusing on any instances where architecture-beta diagrams are rendered from untrusted sources. Applications that do not utilize this specific feature or that sanitize input before processing may not be directly affected. However, given the severity of the vulnerability, it is recommended to upgrade to Mermaid version 11.16.1 or later as a precautionary measure. For detailed information and the latest updates, consult the primary sources provided.
How 0Day mitigates this
mermaid is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.