CVE-2022-36036: Improper Control of Generation of Code ('Code Injection')

August 29, 2022 (updated September 1, 2022)

mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less than 1.3.0 and 2.0.0-rc1. Modify any mermaid code blocks with arbitrary code and it will execute when the component is loaded by MDXjs. This vulnerability was patched in version(s) 1.3.0 and 2.0.0-rc2. There are currently no known workarounds.

References

github.com/advisories/GHSA-rvgm-35jw-q628
github.com/sjwall/mdx-mermaid/commit/f2b99386660fd13316823529c3f1314ebbcdfd2a
github.com/sjwall/mdx-mermaid/security/advisories/GHSA-rvgm-35jw-q628
nvd.nist.gov/vuln/detail/CVE-2022-36036

Code Behaviors & Features

Detect and mitigate CVE-2022-36036 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →