T03 · Remote Payload Retrieval and Execution
- Location
scripts/flowchart_render.py:82- Finding
Automatic Execution of Unpinned External Rendering Components
- Content
View full analysis
Vulnerability Details
File Location:
scripts/flowchart_render.py:82-94
Vulnerability Type: Automatic retrieval and execution of mutable third-party components
Risk Level: HighVulnerable Code
python def _find_mmdc() -> Optional[list]: if shutil.which("mmdc"): return ["mmdc"] if shutil.which("npx"): return ["npx", "-y", "@mermaid-js/mermaid-cli"] if shutil.which("docker"): return [ "docker", "run", "--rm", "-u", f"{os.getuid()}:{os.getgid()}", "-v", f"{os.getcwd()}:/data", "minlag/mermaid-cli", "-" ] return NoneTechnical Analysis
When a locally installed
mmdcexecutable is unavailable, the renderer automatically falls back to:npx -y @mermaid-js/mermaid-cli, which can retrieve and execute the current registry version without user confirmation or an exact version pin.- The mutable Docker image
minlag/mermaid-cli, which is referenced without a digest or immutable version.
Because neither dependency is pinned to a verified immutable artifact, the code executed during rendering may differ from the code that was reviewed. The
-yoption suppresses interactive confirmation, making package retrieval and execution automatic.The Docker fallback additionally mounts the entire current working directory into the container as
/data. A compromised container image could consequently read or modify files in that directory using the invoking user's UID and GID.There is also a documentation discrepancy: the renderer module describes the Docker backend as
ghcr.io/mermaid-js/mermaid-cli, while the implementation executesminlag/mermaid-cli. This makes it harder for users to accurately assess the component that will run.Attack Path
- An attacker compromises a release of
@mermaid-js/mermaid-cli, one of its transitive dependencies, the package registry response, or the mutable `mi ...[truncated 1159 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not automatically retrieve dependencies during normal rendering. Require users to install a reviewed renderer explicitly.
- If automatic retrieval remains supported, require an explicit opt-in flag and display the exact package or image that will be executed.
- Pin the npm package to an exact reviewed version, such as
@mermaid-js/mermaid-cli@x.y.z, and use a lockfile where applicable. - Pin container images by immutable digest rather than a mutable name or tag.
- Use the documented official image consistently and remove the discrepancy between documentation and implementation.
- Verify downloaded artifacts using trusted checksums, signatures, or provenance attestations.
- Mount only a dedicated temporary input/output directory into the container rather than the entire current working directory.
- Make container mounts read-only unless output writing is strictly necessary. Use separate read-only input and narrowly scoped writable output mounts.
- Run the container without network access, with dropped Linux capabilities, a read-only root filesystem, resource limits, and
no-new-privileges. - Document all direct and transitive dependency versions so installations can be reproduced and audited.