T08 · Insecure Dependencies
- Location
src/config.py:92- Finding
Unpinned and Incorrect npm Package Execution Through npx
- Content
View full analysis
Vulnerability Details
File Location:
src/config.py:92-109
Vulnerability Type: Dependency confusion and unpinned package execution
Risk Level: HighVulnerable Code
python import subprocess local_cli = os.path.join( os.path.dirname(__file__), 'node_modules', '@mermaid-js', 'mermaid-cli', 'src', 'cli.js' ) local_cli = os.path.normpath(local_cli) candidates = [ ('local', [local_cli, '--version']), ('local_node', ['node', local_cli, '--version']), ('mmdc', ['mmdc', '--version']), ('npx_mmdc', ['npx', 'mmdc', '--version']), ] for name, cmd in candidates: try: result = subprocess.run( cmd, capture_output=True, text=True, timeout=10 ) if result.returncode == 0: _mermaid_cli_cached = ( local_cli if name in ('local', 'local_node') else cmd[0] ) return _mermaid_cli_cached except Exception: continueTechnical Analysis
The Mermaid CLI discovery routine falls back to executing
npx mmdc --versionwhen earlier candidates are unavailable. Depending on the installed npm/npx version and configuration,npxmay download and execute the named package from the configured npm registry when it is not already installed locally.The package name used by the fallback is
mmdc, whereas the project documentation identifies the intended dependency as@mermaid-js/mermaid-cli. No exact version or integrity hash is specified. Consequently, this fallback can execute a mutable, unreviewed registry package that is not necessarily the intended Mermaid CLI distribution.Although the command uses an argument list rather than
shell=True, preventing ordinary shell metacharacter injection, that does not mitigate package lifecycle scripts or executable code supplied by the resolved npm package.Attack Path
- An attacker publishes, compromises, or otherwise controls the packa ...[truncated 1521 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the automatic
npx mmdcfallback. Do not allow runtime package retrieval during CLI discovery. - Require the official
@mermaid-js/mermaid-clipackage to be installed explicitly before execution. - Pin the dependency to an audited exact version rather than using a floating version.
- Use a lockfile and npm integrity metadata, and install with a reproducible command such as
npm ci. - Resolve the executable only from a trusted, project-controlled path. Reject unknown global or registry-resolved substitutes.
- If automatic installation is unavoidable, use the full official package name with an exact version, require explicit user consent, and verify package integrity before execution.
- Run Mermaid rendering in a sandbox with:
- No access to secrets or unrelated user files.
- A dedicated temporary directory.
- Restricted outbound networking.
- Resource and process limits.
- A low-privilege operating-system identity.
- Treat failure to find the verified CLI as a non-fatal rendering failure rather than attempting to fetch a replacement.
- Add automated tests confirming that CLI detection never contacts a package registry or installs packages.
A safer discovery approach is to accept an administrator-configured absolute executable path, validate that it points to the expected installation, and execute only that path.
- Remove the automatic