Versions of mermaid prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input such as A["<img src=invalid onerror=alert('XSS')></img>"] is provided to the application, it will execute the code instead of rendering it as text due to improper output encoding.

Recommendation

Upgrade to version 8.2.3 or later

References

• mermaid-js/mermaid#847
• https://www.npmjs.com/advisories/751