CVE-2021-43861

Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 to receive a patch. There are no known workarounds aside from upgrading.

• CWE-20
• CWE-79

• https://github.com/mermaid-js/mermaid/commit/066b7a0d0bda274d94a2f2d21e4323dab5776d83Patch, Third Party Advisory
• https://github.com/mermaid-js/mermaid/releases/tag/8.13.8Release Notes, Third Party Advisory
• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-p3rp-vmj9-gv6vThird Party Advisory
• https://github.com/mermaid-js/mermaid/commit/066b7a0d0bda274d94a2f2d21e4323dab5776d83Patch, Third Party Advisory
• https://github.com/mermaid-js/mermaid/releases/tag/8.13.8Release Notes, Third Party Advisory
• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-p3rp-vmj9-gv6vThird Party Advisory

Published

Dec 30, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43856Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and …5.4
• CVE-2021-43857Gerapy is a distributed crawler management framework. Gerapy…8.8
• CVE-2021-43858MinIO is a Kubernetes native application for cloud storage. …8.8
• CVE-2021-43859XStream is an open source java library to serialize objects …7.5
• CVE-2021-4386The WP Security Question plugin for WordPress is vulnerable …4.3
• CVE-2021-43860Flatpak is a Linux application sandboxing and distribution f…8.6
• CVE-2021-43862jQuery Terminal Emulator is a plugin for creating command li…5.4
• CVE-2021-43863The Nextcloud Android app is the Android client for Nextclou…7.5
• CVE-2021-43864Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-43865Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-43866Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-43867Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…