Security readout for executives and security teams
Plain-English summary
Mermaid versions before 9.1.3 can let a low-privileged attacker inject CSS into rendered diagrams. In vulnerable contexts, CSS could affect the surrounding page and may disclose limited sensitive data or mislead users. The risk is highest where untrusted users can submit Mermaid diagrams rendered inside authenticated applications.
Executive priority
Prioritize remediation for authenticated products, portals, wikis, or collaboration tools that render user-submitted Mermaid diagrams. For trusted static content, handle through normal dependency patching. No source evidence indicates active exploitation, but the fixed version is available.
Technical view
CVE-2022-31108 is a CWE-74 injection issue in mermaid.js affecting versions >=8.0.0 and <9.1.3. Arbitrary CSS in generated graph output can influence container HTML outside the graph. The CVSS 3.1 score is 4.1 with network attack vector, low complexity, required privileges, required user interaction, changed scope, and low confidentiality impact.
Likely exposure
Exposure is likely in applications that accept user-controlled Mermaid diagram text and render it in pages containing sensitive fields or trusted UI. Static documentation sites using only trusted diagrams have materially lower risk. The supplied sources name only mermaid-js mermaid versions >=8.0.0 and <9.1.3.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. Exploitation requires the attacker to influence diagram content and a user to view the rendered result. Impact is source-described information disclosure through CSS behavior and possible UI manipulation, not code execution.
Researcher notes
The advisory describes CSS injection into generated graph output with possible cross-page styling effects and limited information disclosure. The fix is version 9.1.3. Evidence is sufficient for affected range and remediation, but the bundle does not provide runtime detection indicators or exploitation-in-the-wild evidence.
Mitigation direction
- Upgrade mermaid to version 9.1.3 or later.
- Escape user input before embedding it in CSS blocks.
- Restrict untrusted users from submitting Mermaid content until upgraded.
- Render untrusted diagrams away from sensitive authenticated UI where feasible.
Validation and detection
- Inventory applications and documentation platforms that load mermaid.js.
- Confirm deployed mermaid versions are not >=8.0.0 and <9.1.3.
- Identify whether Mermaid input can be supplied by untrusted users.
- Review pages rendering diagrams near sensitive fields or privileged actions.
- Verify input escaping controls for CSS-related diagram content.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-74: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-31108 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N2.31.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.1MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-x3vm-38hw-55wfCVE reference · x_refsource_CONFIRM
- https://github.com/mermaid-js/mermaid/commit/0ae1bdb61adff1cd485caff8c62ec6b8ac57b225CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.