CVE-2026-41149
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-94
Control incorrecto de generación de código (Inyección de código)
Fecha de publicación:
22/05/2026
Última modificación:
26/05/2026
Descripción
*** Pendiente de traducción *** Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed .
Impacto
Puntuación base 4.0
5.30
Gravedad 4.0
MEDIA
Referencias a soluciones, herramientas e información
- https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056
- https://github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr