[Vulnerability] OS command injection via Memraid PNG export

[yuriisanin]

The Memraid PNG export functionality is vulnerable to OS command injection due to use of shell option enabled. This could allow an attacker to injection OS command using pngFilePath variable.

File: mermaid.ts (lines: 23-40)

Vulnerable code snippet:

await utility.execFile(
      "npx",
      [
        "-p",
        "@mermaid-js/mermaid-cli",
        "mmdc",
        "--theme",
        themeName,
        "--input",
        info.path,
        "--output",
        pngFilePath,
      ],
      {
        shell: true,
        cwd: projectDirectoryPath,
      },
    );

[yuriisanin]

Assigned CVE-2022-45026