PatchClock

PHP security digest · 23 Sep 2026

This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The module doesn't sufficiently respect defau...

Unrated CVE-2026-96384

Package
drupal/mermaid_diagram_field
Fixed in
1.0.9
Published
Wed 23 Sep 2026, 18:07 LisbonUpdated Mon 26 Oct 2026, 02:25 Lisbon

In plain words

The module does not properly limit access to diagram content shown in a modal and does not sufficiently respect default revision behaviour. An attacker may access modal content when the field has the modal display option enabled, or if they know the modal route and entity ID.

Am I affected?

Look for drupal/mermaid_diagram_field and its version in composer.lock. The advisory lists 1.0.9 as fixed but gives no affected version range. Check whether the field has the modal display option enabled. Disabling that option alone does not rule out exposure, because an attacker could know the modal route and entity ID.

What to do

Check which version you have, then update to a fixed release for your branch (1.0.9):

composer show drupal/mermaid_diagram_field | grep versions
composer update drupal/mermaid_diagram_field

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal.

The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content.

This vulnerability is mitigated by the fact that an attacker must have the modal display option enabled for the field, or otherwise know the route of the modal and entity ID.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.