Mermaid XY Charts are vulnerable to an infinite loop DoS

Impact Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the setXAxisRangeData, when configuring an X-Axis with invalid parameters. As each loop appends an element to an array, this would generally only cause an RangeError: Invalid array length to appear after a few seconds, but...

SiYuan 安全漏洞

SiYuan is an open-source privacy-oriented personal knowledge management system developed by SiYuan itself. Versions of SiYuan 3.6.3 and earlier contained security vulnerabilities. These vulnerabilities stemmed from Mermaid charts being rendered with a relaxed security level, and the generated SVG...

GitLab 跨站脚本漏洞

GitLab is an end-to-end software development platform provided by the American company GitLab. It includes built-in features such as version control, issue tracking, code review, and CI/CD Continuous Integration and Delivery. Versions of GitLab CE/EE prior to 18.8.7, 18.9.3, and 18.10.1 contained...

OneUptime 跨站脚本漏洞

OneUptime is a comprehensive open-source solution developed by OneUptime. It is used to monitor and manage your online services. Versions of OneUptime prior to 10.0.23 contained a cross-site scripting vulnerability. This vulnerability stemmed from the Markdown viewer component rendering Mermaid...

dify 跨站脚本漏洞

dify is an open-source LLM application development platform developed by LangGenius. Versions of dify prior to 1.11.2 had a cross-site scripting vulnerability. This vulnerability stemmed from the relaxed security settings when Mermaid charts were rendered in chat messages, potentially leading to...

beautiful-mermaid 跨站脚本漏洞

Beautiful-Mermaid is a visualization AI assistant tool developed by Craft Docs. Versions of Beautiful-Mermaid prior to 0.1.3 had a cross-site scripting vulnerability. This vulnerability stemmed from an SVG attribute injection issue, which could lead to cross-site scripting attacks when rendering...

CVE-2025-58768

DeepChat is a smart assistant uses artificial intelligence. Prior to version 0.3.5, in the Mermaid chart rendering component, there is a risky operation of directly using innerHTML to set user content. Therefore, any malicious content rendered via Mermaid will directly trigger the exploit chain,...

JetBrains YouTrack Cross-Site Scripting Vulnerability

JetBrains YouTrack is a project management tool developed by the Czech company JetBrains. JetBrains YouTrack suffers from a cross-site scripting vulnerability that stems from the content of Mermaid charts, no details of the vulnerability are provided at this time...

JetBrains YouTrack 跨站脚本漏洞

JetBrains YouTrack is a project management tool developed by the Czech company JetBrains. JetBrains YouTrack suffers from a cross-site scripting vulnerability that stems from the content of Mermaid charts, no details of the vulnerability are provided at this time...