CVE-2026-41149
Severity CVSS v4.0:
MEDIUM
Type:
CWE-94
Code Injection
Publication date:
22/05/2026
Last modified:
26/05/2026
Description
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed .
Impact
Base Score 4.0
5.30
Severity 4.0
MEDIUM
References to Advisories, Solutions, and Tools
- https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056
- https://github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr