CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2022-36036
High (7.8) in mdx-mermaid project mdx-mermaid. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in mdx-mermaid 1.3.0, 2.0.0-rc2.
mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less than 1.3.0 and 2.0.0-rc1. Modify any mermaid code blocks with arbitrary code and it will execute when the component is loaded by MDXjs. This vulnerability was patched in version(s) 1.3.0 and 2.0.0-rc2. There are currently no known workarounds.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mdx-mermaid_project:mdx-mermaid
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rvgm-35jw-q628 | npm | mdx-mermaid | <1.3.0 | 1.3.0 |
| GHSA-rvgm-35jw-q628 | npm | mdx-mermaid | >=2.0.0-rc1 <2.0.0-rc2 | 2.0.0-rc2 |
References
- https://github.com/sjwall/mdx-mermaid/commit/f2b99386660fd13316823529c3f1314ebbcdfd2a
- https://github.com/sjwall/mdx-mermaid/security/advisories/GHSA-rvgm-35jw-q628
- https://github.com/sjwall/mdx-mermaid/commit/f2b99386660fd13316823529c3f1314ebbcdfd2a
- https://github.com/sjwall/mdx-mermaid/security/advisories/GHSA-rvgm-35jw-q628