[Pkg-javascript-devel] Bug#1032313: node-mermaid: CVE-2022-48345

[Salvatore Bonaccorso]

Source: node-mermaid
Version: 8.14.0+~cs11.4.14-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for node-mermaid.

CVE-2022-48345[0]:
| sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via
| HTML entities.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-48345
    https://www.cve.org/CVERecord?id=CVE-2022-48345
[1] https://github.com/braintree/sanitize-url/commit/d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore