TI-2024-25762 Aliases CVE-2024-38527 GHSA-q6xv-jm4v-349h

Cross-site Scripting in ZenUML

MEDIUM 58CWE-79Published 2024-06-26 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting (XSS). The comment feature allows the user to attach small notes for reference. This feature allows the user to enter in their comment in markdown comment, allowing them to use common markdown features, such as `**` for bolded text. However, the markdown text is currently not sanitized before rendering, allowing an attacker to enter a malicious payload for the comment which leads to XSS. This puts existing applications that use ZenUML unsandboxed at risk of arbitrary JavaScript execution when rendering user-controlled diagrams. This vulnerability was patched in version 3.23.25,

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00381 32nd percentileScored 2026-11-07

Fix Fixed zenuml-core (mermaid-js): 3.23.25@zenuml/core (npm): 3.23.25

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
mermaid-js	zenuml-core	before 3.23.25	3.23.25	Patch available	CNA
—	@zenuml/core (npm)	before 3.23.25	3.23.25	Patch available	GHSA-q6xv-jm4v-349h

zenuml-core Vendormermaid-js Affected before 3.23.25 Fixed in 3.23.25 Patch available CNA
@zenuml/core (npm) Vendor— Affected before 3.23.25 Fixed in 3.23.25 Patch available GHSA-q6xv-jm4v-349h

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mermaidjs:zenuml-core::::::::	—	—	—

cpe:2.3:a:mermaidjs:zenuml-core:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA zenuml-core (mermaid-js) Fixed in 3.23.25
Fix · GHSA-q6xv-jm4v-349h @zenuml/core (npm) Fixed in 3.23.25 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-38527
2026-10-03 Alias added: GHSA-q6xv-jm4v-349h

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-38527

Other 3

TI-2026-29778 Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS CVSS 4.0MEDIUM 5.3
TI-2025-34615 Mermaid improperly sanitizes of sequence diagram labels leading to XSS CVSS 4.0MEDIUM 5.3
TI-2026-50057 Mermaid Architecture diagrams are vulnerable to prototype pollution CVSS 4.0MEDIUM 6.5
TI-2022-13152 Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js CVSS 3.1MEDIUM 6.1
TI-2026-29777 Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection CVSS 4.0MEDIUM 5.3
TI-2025-34614 Mermaid does not properly sanitize architecture diagram iconText leading to XSS CVSS 4.0MEDIUM 5.1

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences