CyberRota Analysis
AI-GeneratedMermaid, a JavaScript tool used for creating diagrams and charts, is vulnerable to CSS injection due to improper handling of class or ID names supplied in diagram text, affecting versions prior to 10.9.8 and 11.16.1. An attacker could exploit this vulnerability to inject arbitrary CSS, potentially compromising the appearance and functionality of other elements on the page. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1.