CVE-2026-41148

What it actually does

This vulnerability is a client-side CSS injection flaw in Mermaid diagram rendering. User-controlled style values, especially classDef values in state diagrams and any other diagram type using the same createCssStyles parsing path, are insufficiently sanitized before being written to style.innerHTML. By inserting a closing brace into a Mermaid style value, an attacker can break out of the intended generated CSS selector and inject new CSS rules into the hosting page. The practical impact is page defacement, CSS-based user tracking through external url() callbacks, and limited DOM data exposure through CSS selector and attribute-based exfiltration techniques. Despite the assigned family, this issue is not typical server-side remote code execution; exploitation occurs in the browser context of users who view attacker-controlled Mermaid content.

Why it matters to the business

Applications that allow users to create, edit, import, or display Mermaid diagrams can be used to alter the appearance of trusted pages, trigger browser requests to attacker-controlled infrastructure, and potentially leak limited page or form-state information visible to CSS. This is most relevant for documentation platforms, wikis, issue trackers, knowledge bases, developer portals, chat systems, and Markdown previewers that render untrusted Mermaid content. The current EPSS is low and stable, it is not listed in CISA KEV, and there is no known exploit maturity reported, but the vulnerability is simple to understand and the affected library is commonly embedded downstream, so organizations should patch during normal priority security maintenance and prioritize internet-facing or multi-user content platforms.

How an attack unfolds

An attacker first identifies a place where Mermaid diagrams are rendered from user-supplied Markdown or diagram text. They submit or modify a diagram containing a crafted classDef style value that includes a closing CSS brace. When another user views the page, Mermaid parses the diagram and passes the unsanitized style string into its CSS generation path. Because the string is assigned into a style element using innerHTML, the attacker-controlled closing brace terminates the intended Mermaid CSS rule and causes subsequent attacker-supplied text to be interpreted as independent CSS. The injected CSS can visually alter the page, hide or overlay content, cause the victim browser to request attacker-controlled URLs for tracking, or use CSS selectors to infer and leak limited DOM attributes or state through outbound requests. Exploitation requires a victim to view the malicious rendered diagram, but does not require authentication if the target application permits public diagram submission or renders attacker-controlled content.

How to fix it

Upgrade Mermaid to a fixed release: version 10.9.6 or later on the 10.x line, or version 11.15.0 or later on the 11.x line. Versions 10.9.5 and earlier, and 11.0.0-alpha.1 through 11.12.0, are described as vulnerable. Because Mermaid is often bundled through downstream packages, audit direct and transitive dependencies in package-lock.json, yarn.lock, pnpm-lock.yaml, bundled frontend assets, CDN references, and vendored JavaScript. If immediate upgrade is not possible, configure Mermaid with securityLevel: "sandbox" so diagrams render inside a sandboxed iframe, reducing exposure from injected styles. Also avoid rendering untrusted Mermaid content in privileged application pages, enforce a restrictive Content Security Policy that limits style and image/font/connect destinations, and review whether Markdown preview or diagram rendering features can be disabled for untrusted users until patched.

How to confirm the fix worked

Confirm that all deployed Mermaid copies report version 10.9.6 or 11.15.0 or later, including bundled frontend builds and CDN-pinned assets. Verify package managers and build artifacts do not still contain vulnerable Mermaid versions through npm ls mermaid, lockfile review, software composition analysis, or static asset inspection. For mitigated deployments, confirm Mermaid is initialized with securityLevel set to sandbox and that rendered diagrams are placed in a sandboxed iframe. Perform a safe validation using a non-exfiltrating test diagram that attempts to inject a harmless CSS rule after a closing brace; the page should not apply attacker-controlled CSS outside the intended Mermaid diagram styling. Also confirm CSP prevents arbitrary external CSS-triggered resource loads from rendered content areas.

Typical attack path

1. Find an application that renders Mermaid diagrams from user-controlled Markdown, comments, tickets, documentation, or imported content.
2. Create a Mermaid diagram, commonly a state diagram, containing a crafted classDef style value with CSS syntax that escapes the intended Mermaid-generated rule.
3. Submit, publish, or share the malicious diagram in a location that will be rendered by other users.
4. Wait for a victim to open the page or preview where the Mermaid diagram is rendered.
5. Mermaid generates a style element containing attacker-injected CSS because the style value is not properly sanitized.
6. The victim browser applies the injected CSS, enabling page manipulation, tracking requests to attacker-controlled URLs, or limited CSS-based data inference/exfiltration.

How to detect it

To determine whether this was already exploited, examine content stores and audit logs for Mermaid diagram submissions or edits containing suspicious CSS escape patterns. Focus on Markdown pages, comments, tickets, documentation edits, pull request descriptions, chat messages, imported files, and any feature that renders Mermaid. Useful log sources include application content-change audit logs, web access logs around diagram-rendering pages, CDN logs for Mermaid assets, browser or endpoint telemetry if available, CSP violation reports, outbound proxy logs, DNS logs, and WAF logs. Look for Mermaid classDef lines that contain a closing brace before the line ends, followed by CSS rules, url() references, @import statements, or attribute selectors. Network evidence may appear as victim browsers requesting attacker-controlled image, font, CSS, or other resource URLs shortly after viewing pages containing Mermaid diagrams; Referer headers may point to documentation or Markdown-rendering pages. CSP reports may show blocked external image, font, style, or connect attempts from pages that normally should not contact those domains. Because injected CSS runs in the browser and may not create server-side errors, stored content review and client-side egress telemetry are the most important detection sources.

• classDef .*}
• classDef .*url(
• classDef .*@import
• classDef .*background:url(
• classDef .*background-image:url(
• classDef .*content:url(
• classDef .*font-face
• } body {
• }body{
• } html {
• }html{
• @import url(
• background:url(
• background-image:url(
• content:url(
• url(//
• url(http://
• url(https://
• input[value^=
• input[name=
• textarea[value^=
• select option:checked

What your security team should do

• Inventory all applications and frontend bundles that render Mermaid diagrams, including documentation systems, wikis, issue trackers, developer portals, Markdown editors, and static site generators.
• Upgrade Mermaid to 10.9.6 or 11.15.0 or later, prioritizing externally reachable and multi-user platforms where untrusted users can submit Markdown or diagram content.
• Where patching is delayed, set Mermaid securityLevel to sandbox and restrict rendering of untrusted diagrams.
• Search stored Markdown, comments, documentation pages, tickets, and uploaded content for suspicious Mermaid classDef styles containing closing braces, external url() references, @import, or CSS selectors used for exfiltration.
• Review web access logs, CSP reports, proxy logs, and DNS telemetry for unexpected outbound requests triggered from pages that render Mermaid diagrams.
• Add regression tests to ensure Mermaid diagram styles cannot break out of generated selectors and inject page-level CSS.
• Maintain a restrictive CSP for pages that render user-authored content, especially limiting img-src, font-src, style-src, and connect-src to approved domains.