{"id":"CVE-2021-43861","details":"Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 to receive a patch. There are no known workarounds aside from upgrading.","aliases":["GHSA-p3rp-vmj9-gv6v"],"modified":"2026-08-07T19:47:02.757157Z","published":"2021-12-30T14:15:07.547Z","references":[{"type":"ADVISORY","url":"https://github.com/mermaid-js/mermaid/releases/tag/8.13.8"},{"type":"ADVISORY","url":"https://github.com/mermaid-js/mermaid/security/advisories/GHSA-p3rp-vmj9-gv6v"},{"type":"FIX","url":"https://github.com/mermaid-js/mermaid/commit/066b7a0d0bda274d94a2f2d21e4323dab5776d83"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mermaid-js/mermaid","events":[{"introduced":"0"},{"fixed":"65592e0541790968703f16bc0b91a641b5443111"},{"fixed":"066b7a0d0bda274d94a2f2d21e4323dab5776d83"}],"database_specific":{"cpe":"cpe:2.3:a:mermaid_project:mermaid:*:*:*:*:*:node.js:*:*","extracted_events":[{"introduced":"0"},{"fixed":"8.13.8"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["8.13.7","8.13.6","8.13.5","8.12.1","8.11.4","8.11.3","8.11.0-rc2","8.9.3","8.9.1","8.8.3","8.8.0","8.7.0","8.6.2","8.6.0","8.5.2","untagged-566ebfbf21141b604025","8.5.1","untagged-31c93788afe260d914bb","8.4.8","untagged-7651dabb407ecd5631ce","8.4.6","untagged-f43366252632a1a42020","8.4.4","8.2.0","8.3.0","8.2.6","8.2.5","8.2.4","8.2.3","8.2.2","8.1.0","8.2.1","7.0.5","7.0.3","7.0.2","7.0.0","6.0.0","0.5.7","0.5.6","0.5.5","0.5.4","0.5.3","0.5.2","0.5.1","0.5.0","0.4.0","0.3.5","0.3.4","0.3.3","0.3.2","0.3.1","0.3.0","0.2.16","0.2.15","0.2.14","0.2.13","0.2.8","0.2.7","0.2.6","0.2.5","0.2.4","0.2.3","0.2.2","0.2.1","0.2.0","0.1.1","0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43861.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}