CVE-2022-36036

mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less than 1.3.0 and 2.0.0-rc1. Modify any mermaid code blocks with arbitrary code and it will execute when the component is loaded by MDXjs. This vulnerability was patched in version(s) 1.3.0 and 2.0.0-rc2. There are currently no known workarounds.

• CWE-94

• https://github.com/sjwall/mdx-mermaid/commit/f2b99386660fd13316823529c3f1314ebbcdfd2aPatch, Third Party Advisory
• https://github.com/sjwall/mdx-mermaid/security/advisories/GHSA-rvgm-35jw-q628Exploit, Third Party Advisory
• https://github.com/sjwall/mdx-mermaid/commit/f2b99386660fd13316823529c3f1314ebbcdfd2aPatch, Third Party Advisory
• https://github.com/sjwall/mdx-mermaid/security/advisories/GHSA-rvgm-35jw-q628Exploit, Third Party Advisory

Published

Aug 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36030Project-nexus is a general-purpose blog website framework. A…9.8
• CVE-2022-36031Directus is a free and open-source data platform for headles…6.5
• CVE-2022-36032ReactPHP HTTP is a streaming HTTP client and server implemen…5.3
• CVE-2022-36033jsoup is a Java HTML parser, built for HTML editing, cleanin…6.1
• CVE-2022-36034nitrado.js is a type safe wrapper for the Nitrado API. Possi…7.5
• CVE-2022-36035Flux is a tool for keeping Kubernetes clusters in sync with …7.8
• CVE-2022-36037kirby is a content management system (CMS) that adapts to ma…5.4
• CVE-2022-36038CircuitVerse is an open-source platform which allows users t…7.8
• CVE-2022-36039Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2022-3604The Contact Form Entries WordPress plugin before 1.3.0 does …7.8
• CVE-2022-36040Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2022-36041Rizin is a UNIX-like reverse engineering framework and comma…7.8