SA-CONTRIB-2026-180: Critical severity drupal/mermaid_diagram_field vulnerability
This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content. This vulnerability is mitigated by the fact that an attacker must have the modal display option enabled for the field, or otherwise know the route of the modal and entity ID.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/mermaid_diagram_fieldto a version that resolves this vulnerability.Fixed in 1.0.10
Event History
Frequently Asked Questions
Who is most likely to be exposed to this issue?
Sites using the Mermaid Diagram Field module are exposed when a field is configured with the modal display option. The advisory also indicates exposure may exist if an attacker knows the modal route and an entity ID.
What does an attacker need to exploit it?
An attacker needs the modal display option enabled for the field, or knowledge of the modal route and the relevant entity ID. The issue involves insufficient access restrictions for modal content and incorrect handling of default revision behavior.
What can be done while a permanent fix is unavailable?
Disable the modal display option for affected fields where possible. Restricting knowledge or access to the modal route and entity IDs may also reduce exposure, but the provided information does not describe a complete workaround.