The vulnerability in beautiful-mermaid arises from improper neutralization of input during web page generation. Specifically, user-controlled values from Mermaid style and classDef directives are interpolated directly into SVG attribute values without proper escaping. This allows crafted input to break out of the attribute context and inject arbitrary SVG elements or attributes into the rendered SVG output. When this SVG is embedded in a web page, it can lead to script execution in the context of the embedding origin, constituting a cross-site scripting (XSS) vulnerability. The issue affects versions prior to 0.1.3.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the embedding web page's origin. This can lead to theft of sensitive information, session hijacking, or other malicious actions permitted by script execution in the victim's browser. The vulnerability is limited to scenarios where attacker-controlled Mermaid diagrams are rendered and embedded in web pages.

No official patch or fix is currently available for this vulnerability. Users should avoid rendering untrusted Mermaid diagrams with affected versions of beautiful-mermaid. Monitor the vendor's advisory channels for updates or patches addressing this issue. Applying input sanitization or escaping on Mermaid style and classDef directives before rendering may reduce risk but is not a guaranteed fix.