CVE-2022-36036

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less than 1.3.0 and 2.0.0-rc1. Modify any mermaid code blocks with arbitrary code and it will execute when the component is loaded by MDXjs. This vulnerability was patched in version(s) 1.3.0 and 2.0.0-rc2. There are currently no known workarounds.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Aug 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-360375.4kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface. Cross-site s CVE-2022-360387.8CircuitVerse is an open-source platform which allows users to construct digital logic circuits online. A remote code execution (RCE) vulnera CVE-2022-360397.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to out-of-bounds write CVE-2022-36047.8The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injecti CVE-2022-360407.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds wri CVE-2022-360417.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds wri CVE-2022-360427.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds wri CVE-2022-360437.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to a double free in bob CVE-2022-360447.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds wri CVE-2022-360459.8NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instan CVE-2022-360465.3Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected b CVE-2022-360484.3Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embed