T03 · Remote Payload Retrieval and Execution
Warning
- Location
references/libraries.md:11- Finding
Generated pages execute mutable third-party JavaScript from remote CDNs
- Content
View full analysis
import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs'; mermaid.initialize({ startOnLoad: true, /* ... */ }); ``` ```html ``` The templates directly implement the same imports: ```js import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs'; import elkLayouts from 'https://cdn.jsdelivr.net/npm/@mermaid-js/layout-elk/dist/mermaid-layout-elk.esm.min.mjs'; ``` ### Technical Analysis The generated HTML executes JavaScript modules obtained at page-load time from a third-party CDN. The Mermaid import is constrained only to the mutable major-version alias `@11`, while the ELK layout package has no version constraint at all. Neither resource is tied to an immutable artifact or verified using an integrity mechanism. Consequently, the effective executable payload can change after the Skill package has been reviewed. A compromised package publisher, package registry, CDN, or upstream release process could replace the delivered module with malicious JavaScript. Because these are ECMAScript module imports, the retrieved code executes automatically in the page's browser context. The pages may contain proprietary architecture diagrams, code-review content, project plans, operational data, or other sensitive ma ...[truncated 1434 chars]- Remediation
View remediation