Prototype pollution in mermaid - #VU140936

Vulnerability details

The vulnerability allows a local privileged user to modify object prototypes.

The vulnerability exists due to improperly controlled modification of object prototype attributes in the mermaid configuration setters when merging caller-supplied configuration objects into the internal config. A local privileged user can supply a crafted configuration object to modify object prototypes.

The issue is only reachable if an application forwards attacker-controlled data directly into these configuration entry points; user-controlled configuration in diagram code and YAML frontmatter is already protected.

Affected software

Remediation

External References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v
• https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43