CVE-2026-41149

MediumCVSS 5.3/10Last modified Jul 23, 2026

Description

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, <script> tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed <iframe>.

Metrics

CVSS 4.0 5.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
mermaid-js	mermaid	>= 11.0.0-alpha.1, < 11.15.0; < 10.9.6

References

Timeline

Published: May 22, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-41153.7A vulnerability was detected in PuTTY 0.83. Affected is the function eddsa_verify of the file crypto/ecc-ssh.c of the component Ed25519 Sign CVE-2026-411505.3Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there i CVE-2026-411539.8In JetBrains Junie before 252.549.29 command execution was possible via malicious project file CVE-2026-411547.8Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing page CVE-2026-411555.5An attacker could cooperatively pass data from one secure GPU process to another secure GPU process through shared secure memory allocations CVE-2026-411567.7Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a wri CVE-2026-411579.8A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU use CVE-2026-411587.8Software installed and run as a non-privileged user may conduct GPU system calls to write to arbitrary freed physical pages. Physical mem CVE-2026-411595.3Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, Mermai CVE-2026-41167.2Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/C CVE-2026-411604.3EspoCRM is an open source customer relationship management application. Prior to 9.3.5, a business logic flaw (Broken Access Control) in Esp CVE-2026-411615.3Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.2.0, the /api/aut