Most recent entries from all

EUVD-2026-232646

2026-10-16T01:52:36.572691+00:00

EUVD-2026-232646

fkie_cve-2022-36036

2026-10-16T01:52:36.572721+00:00

mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less than 1.3.0 and 2.0.0-rc1. Modify any mermaid code blocks with arbitrary code and it will execute when the component is loaded by MDXjs. This vulnerability was patched in version(s) 1.3.0 and 2.0.0-rc2. There are currently no known workarounds.

GHSA-rvgm-35jw-q628 — Improper Control of Generation of Code ('Code Injection') in mdx-mermaid

2026-10-16T01:52:36.572751+00:00

Affected: npm: mdx-mermaid

### Impact

Arbitary javascript injection

Modify any mermaid code blocks with the following code and the code inside will execute when the component is loaded by MDXjs

``` ` + (function () { // Put Javascript code here return '' }()) + ` ```

The block below shows a valid mermaid code block

````md ```mermaid graph TD; A-->B; A-->C; B-->D; C-->D; ``` ````

The same block but with the exploit added

````md ```mermaid ` + (function () { alert('vulnerable') return '' }()) + ` graph TD; A-->B; A-->C; B-->D; C-->D; ``` ````

### Patches 1.3.0 and 2.0.0-rc2

### Workarounds None known

gsd-2022-36036

2026-10-16T01:52:36.572786+00:00

gsd-2022-36036