Summary: Mermaid renders with securityLevel: 'loose', which allows raw HTML inside diagram labels to survive rendering. MermaidBlock injects the rendered SVG straight into the DOM via dangerouslySetInnerHTML without sanitization, so a crafted diagram can execute script, abuse on* handlers, or navigate via javascript: URLs in the renderer context.
Area: Web UI
Reproduction or evidence: src/web-ui/src/component-library/components/Markdown/MermaidBlock.tsx:209 assigns svgContent (produced by MermaidService.renderDiagram, cache path :59/:95) directly to dangerouslySetInnerHTML; no sanitization exists anywhere in the render chain. With securityLevel: 'loose', a mermaid diagram containing <img onerror=...> / <script> / javascript: href inside a label yields executable markup in the DOM.
Environment: BitFun version/commit 32f2427 (origin/main), mermaid ^11.10.1.
Summary: Mermaid renders with
securityLevel: 'loose', which allows raw HTML inside diagram labels to survive rendering. MermaidBlock injects the rendered SVG straight into the DOM viadangerouslySetInnerHTMLwithout sanitization, so a crafted diagram can execute script, abuseon*handlers, or navigate viajavascript:URLs in the renderer context.Area: Web UI
Reproduction or evidence:
src/web-ui/src/component-library/components/Markdown/MermaidBlock.tsx:209assignssvgContent(produced byMermaidService.renderDiagram, cache path :59/:95) directly todangerouslySetInnerHTML; no sanitization exists anywhere in the render chain. WithsecurityLevel: 'loose', a mermaid diagram containing<img onerror=...>/<script>/javascript:href inside a label yields executable markup in the DOM.Environment: BitFun version/commit 32f2427 (origin/main), mermaid ^11.10.1.