guide.html pins mermaid@10.9.4, which has published security advisories fixed only in 10.9.6 and 10.9.8 (CR-A18-064) #467

Wave 2 · theme D2-1: Security and integrity: medium/large effort · highest severity Low · 2 finding(s) · effort small

Summary

Diagrams in the bundled manuals are authored by ForgeLM, so exploitation needs an attacker-controlled diagram source, which the static bundle does not take. Exposure is limited to a future manual edit pulling in untrusted diagram text, so this is a stale-dependency issue, not a live exploit.

Primary finding

CR-A18-064 — guide.html pins mermaid@10.9.4, which has published security advisories fixed only in 10.9.6 and 10.9.8

severity Low · reachability default · intent intended-but-harmful · confidence likely · single reviewer · not reproduced (code trace)

What happens. The user-manual SPA loads mermaid 10.9.4 from jsDelivr. The SRI hash is correct for that file, which I verified by computing sha384. GitHub advisories (fetched by an earlier step of this unit) list GHSA-87f9-hvmw-gh4p, 6m6c-36f7-fhxh, ghcm-xqfw-q4vr and xcj9-9m2h as affecting <=10.9.5 (fixed 10.9.6), and GHSA-c4c3-pg64-4m4v, 6x64-9x62-f2gx and 2v8p-3f2j-5mp7 as affecting <10.9.8 (fixed 10.9.8). The 10.9 line has a backport tag at 10.9.8, and latest is 12.0.0.

Where.

• site/guide.html:40-43
• site/js/guide.js:638-665
• site/js/guide.js:262-266

Evidence.

• site/guide.html:40-43. Advisory ids and versions come from a web fetch during an earlier checkpointed step; I did not re-fetch them in this attempt.

Recommended fix. Bump to mermaid 10.9.8 (same API, regenerate SRI) or to the current major after checking mermaid.run/initialize usage in guide.js.

Other findings with the same root cause

These close with the same fix; update them in the same pull request.

TECH-T16-001 — Site and browser stack: mermaid 10.9.4 loaded from cdn.jsdelivr.net with SRI (site/guide.html:40-43) (outdated)

severity Next release

Item. mermaid 10.9.4 loaded from cdn.jsdelivr.net with SRI (site/guide.html:40-43) · verdict: outdated · urgency: Next release

State in ForgeLM. site/guide.html:40-43 loads https://cdn.jsdelivr.net/npm/mermaid@10.9.4/dist/mermaid.min.js synchronously in (no defer). It carries integrity sha384-fGOpyux4znQZ+n4tUrYReB2Ulu6K1MtBxIkbHauU09YM1hvCyA5oX9JUc1hRkDEr, crossorigin=anonymous and referrerpolicy=no-referrer. I recomputed the hash from the cached jsDelivr file (3,336,822 bytes) and it matches. site/js/guide.js:645 initialises with securityLevel 'strict'. The theme re-init at guide.js:671 passes only {startOnLoad, theme}: securityLevel stays at mermaid's default ('strict') and themeVariables are dropped (cosmetic). Diagram text is first-party: tools/build_usermanuals.py:191 turns the docs/usermanuals mermaid fences into div.mermaid at build time. The version string 'Mermaid 10.9.4' is hard-coded in all six privacy.body locales (site/js/translations.js:4345, 4354, 4363, 4372, 4381, 4390).

State of the ecosystem on 2026-10-01. I re-fetched the npm packument today and it is byte-identical to both researchers' copies. dist-tag latest = 12.0.0 (2026-09-10); backport = 10.9.8 (2026-08-04); 11.x tops out at 11.17.2 (2026-08-25). On the 10.x line, 10.9.5 came out 2025-11-04 and 10.9.6 2026-05-11; 10.9.7 was never published (publish error, per the v10.9.8 notes). 10.9.4 dates from 2025-08-20. OSV lists 7 advisories whose affected range includes 10.9.4. Fixed in 10.9.6: GHSA-6m6c-36f7-fhxh / CVE-2026-41150, GHSA-xcj9-5m2h-648r / CVE-2026-41148, GHSA-ghcm-xqfw-q4vr / CVE-2026-41149 and GHSA-87f9-hvmw-gh4p / CVE-2026-41159. Fixed in 10.9.8: GHSA-2v8p-3f2j-5mp7 / CVE-2026-71436 (introduced 10.6.0), GHSA-6x64-9x62-f2gx / CVE-2026-50159 and GHSA-c4c3-pg64-4m4v / CVE-2026-71438. Six are MODERATE and c4c3 is LOW. GHSA-7rqq-prvp-x9jh was fixed in 10.9.4, and 3rrr, rhh3 and 8gwm affect only 11.x. Mermaid's security page names no supported-versions or EOL policy and tells users to update pinned versions. The 12.0.0 release requires ES2024, Safari 17.4+ and Node 22.12+, and makes ELK the default layout. The SRI for the 10.9.8 dist file is sha384-N3QqR/7q+xm3BGX+CBbNI8AUmRRqcsDzToy+0z1NLDI0QmTKW8zvwLvqulJgk3dP (3,337,857 bytes, recomputed).

Impact. This is hygiene and hardening, not a reachable vulnerability. Every advisory needs attacker-controlled diagram source or mermaid config. The site renders only maintainer-authored docs (TC-T under TM-v1, family 11 static bundle) with securityLevel strict, and the SRI pins the exact bytes. Still, the public site ships a version with 7 published advisories while a drop-in patched build exists on the same line, and any scanner will flag it. A version bump also has to touch six translation strings, and nothing guards that coupling.

Recommendation. Bump site/guide.html:40-41 to mermaid@10.9.8 with integrity sha384-N3QqR/7q+xm3BGX+CBbNI8AUmRRqcsDzToy+0z1NLDI0QmTKW8zvwLvqulJgk3dP, and in the same change update 'Mermaid 10.9.4' in the six privacy.body strings. Pass securityLevel:'strict' explicitly in the re-init at guide.js:671. Treat 12.x as a separate decision: it raises the browser floor to ES2024 / Safari 17.4 and re-lays out every diagram (set layout: dagre, theme: default, look: classic to keep the old look). Optionally vendor the pinned file under site/js/ to remove the jsDelivr request and its privacy disclosure. Optionally add defer to the script tag.

Sources.

• npm registry packument for mermaid (dist-tags latest 12.0.0, backport 10.9.8; publish times) (2026-09-10 (registry modified))
• OSV advisories for npm mermaid (ranges, severity) (records modified up to 2026-09-10)
• mermaid-js/mermaid GitHub releases (mermaid@12.0.0, v10.9.8, v10.9.6 notes) (2026-09-10 / 2026-08-04 / 2026-05-11)
• Release v10.9.8 (backports GHSA-c4c3/6x64/2v8p; 10.9.7 skipped) (2026-08-04)
• Mermaid allows CSS injection applying to sibling elements of the diagram (CVE-2026-50159) (2026-08-06)
• mermaid 10.9.4 dist file (SRI recomputed, matches guide.html:41) (2025-08-20 (npm publish))

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}