CVE-2022-31108

Mermaid is a JavaScript based diagramming and charting tool that uses
Markdown-inspired text definitions and a renderer to create and modify
complex diagrams. An attacker is able to inject arbitrary CSS into the
generated graph allowing them to change the styling of elements outside of
the generated graph, and potentially exfiltrate sensitive information by
using specially crafted CSS selectors. The following example shows how an
attacker can exfiltrate the contents of an input field by bruteforcing the
value attribute one character at a time. Whenever there is an actual
match, an http request will be made by the browser in order to “load” a
background image that will let an attacker know what’s the value of the
character. This issue may lead to Information Disclosure via CSS
selectors and functions able to generate HTTP requests. This also allows an
attacker to change the document in ways which may lead a user to perform
unintended actions, such as clicking on a link, etc. This issue has been
resolved in version 9.1.3. Users are advised to upgrade. Users unable to
upgrade should ensure that user input is adequately escaped before
embedding it in CSS blocks.