(Low) Aikido > "sanitize-url" XSS vulnerability > Upgrade "marmaid" version

[tom-vism]

AIKIDO-2024-10096

Affected versions of the @braintree/sanitize-url library are vulnerable to Cross-site Scripting (XSS). If you are using this library for sanitizing urls, certain whitespace sequences are not correctly escaped and can lead to an XSS attack

How to fix:
Use 11.0.0-alpha.7 version for "mermaid" package (which has dependency @braintree/sanitize-url": "^7.0.1" and it fixes the issue)

[jfcere]

Dependency has been updated to support mermaid 11.0.0 and released as part of ngx-markdown v18.1.0.