Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex d...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 10.9.0-rc.1 to 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Ubuntu:22.04:LTS node-mermaid

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.10 node-mermaid

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

参照URL

report ubuntu.com
report cve.org
report github.com
report github.com
report github.com