AIKIDO-2026-10460
astro-mermaid is vulnerable to Cross-Site Scripting (XSS)
61
Medium Risk
This Affects:
astro-mermaidTL;DR
The Astro Mermaid integration injects client-side script into built sites. Previously, icon packs could be executed via new Function built from serialized loader data, and Mermaid error handling interpolated error.message into innerHTML, allowing script or markup injection. Related paths embedded unsanitized JSON in inline scripts, had weak HAST attribute and tag handling, and allowed prototype pollution through mermaidConfig merging. The fix removes dynamic execution in favor of URL-based loading and fetch, uses safer DOM APIs and escaping, tightens serialization and allowlists, and rejects dangerous keys on config objects.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
astro-mermaid is vulnerable to Cross-Site Scripting (XSS) in versions 1.0.0 - 1.4.0.
How to fix this
Upgrade the astro-mermaid library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant