CVE-2026-41150

What it actually does

This vulnerability causes a denial of service in Mermaid when rendering specially crafted Gantt charts. In affected versions before 10.9.6 and 11.15.0, a diagram that uses the Gantt chart `excludes` attribute to exclude all dates can trigger pathological behavior during task processing/rendering, including when `ganttDb.getTasks()` is reached. `mermaid.parse` alone is not the vulnerable operation unless the parsed Gantt diagram is subsequently rendered or task data is retrieved. The result is reduced availability of the browser tab, renderer process, documentation preview, CI documentation job, or application component that processes Mermaid diagrams.

Why it matters to the business

Applications, documentation portals, issue trackers, wikis, markdown previewers, build pipelines, and collaboration tools that render user-supplied Mermaid diagrams may become slow, unresponsive, or unavailable when a malicious or accidental Gantt chart is processed. The CVSS score is moderate and EPSS is low, with no known KEV listing or reported exploit maturity, but the issue is still operationally relevant wherever untrusted users can submit Markdown or Mermaid content that is rendered for others. Because Mermaid is commonly embedded downstream in many products and documentation workflows, exposure may exist indirectly through packaged renderers, static site generators, or markdown preview components.

How an attack unfolds

An attacker identifies a location where Mermaid diagrams are accepted and rendered, such as a markdown field, documentation repository, wiki page, issue comment, pull request description, chat integration, or preview service. They submit a Mermaid Gantt chart containing an `excludes` configuration that excludes all dates. The content may pass syntax parsing, because the vulnerable behavior is associated with rendering or with calling Gantt task retrieval logic rather than `mermaid.parse` by itself. When a victim, automated previewer, or server-side renderer processes the diagram, the renderer enters a resource-consuming failure mode and the affected page, worker, browser tab, or rendering service becomes unavailable or degraded. Exploitation generally requires that the malicious diagram be rendered, so risk is highest for systems that automatically render untrusted Mermaid content.

How to fix it

Upgrade Mermaid to a fixed release: use Mermaid 10.9.6 or later on the 10.x line, or Mermaid 11.15.0 or later on the 11.x line. Because Mermaid is often bundled by other tools, also update dependent packages, documentation platforms, markdown renderers, static site generators, browser extensions, and applications that vendor or pin Mermaid. If immediate upgrade is not possible, mitigate by disabling Mermaid rendering for untrusted content, disabling Gantt chart rendering, rendering diagrams in a sandboxed and resource-limited worker, applying strict render timeouts, and rejecting or sanitizing Gantt diagrams where `excludes` excludes the complete date range. Treat server-side rendering of user-provided Mermaid as higher risk and isolate it from core application services.

How to confirm the fix worked

Confirm that all deployed Mermaid instances resolve to version 10.9.6 or later for 10.x, or 11.15.0 or later for 11.x. Review lockfiles, bundled JavaScript assets, container images, static documentation build dependencies, and transitive packages for vulnerable Mermaid versions. Test a non-production renderer with a crafted Gantt diagram using `excludes` to remove all dates and verify that rendering fails safely, times out, or completes without hanging. For web applications, verify that untrusted Mermaid rendering is sandboxed and that browser or server-side workers are terminated on excessive CPU time. For packaged products, confirm the vendor has incorporated the fixed Mermaid release rather than only updating top-level application version numbers.

Typical attack path

1. Find an application or workflow that supports Mermaid diagram rendering from user-controlled Markdown or text input.
2. Create a Mermaid Gantt chart that uses the `excludes` attribute in a way that excludes all dates in the chart range.
3. Submit the diagram through a wiki page, documentation commit, issue comment, pull request, chat message, CMS field, or other content source.
4. Wait for a user, browser preview, static-site build, markdown renderer, or server-side rendering worker to render the diagram.
5. Trigger excessive processing or renderer failure when Gantt task data is processed, causing local or service-level denial of service.

How to detect it

Look for evidence that untrusted Mermaid Gantt diagrams were submitted or rendered shortly before browser freezes, renderer crashes, worker timeouts, CI job failures, or documentation preview outages. Relevant sources include application request logs, markdown submission history, wiki or issue-comment audit logs, source control commits and pull requests, static-site build logs, browser telemetry, JavaScript error reporting, server-side rendering worker logs, container CPU and memory metrics, and WAF or reverse-proxy logs for markdown content submissions. Search for Mermaid fenced code blocks or diagram definitions containing `gantt` and `excludes`, especially where the excluded dates cover the entire project date range or where rendering repeatedly times out. Because this is a denial-of-service issue rather than code execution, indicators are more likely to be malicious content artifacts and resource-exhaustion symptoms than malware files or persistence artifacts. There are no known named threat actors or KEV exploitation reports for this vulnerability based on the provided intelligence.

• ```mermaid
• gantt
• excludes
• ganttDb.getTasks()
• mermaid.parse
• Error rendering Mermaid diagram
• Mermaid render timeout
• Mermaid rendering failed
• excludes weekends
• excludes saturday,sunday
• excludes 202
• section

What your security team should do

• Inventory applications, documentation systems, developer portals, wikis, markdown previewers, and CI/CD documentation jobs that render Mermaid diagrams.
• Prioritize upgrades where Mermaid content can be submitted by untrusted or low-privileged users and automatically rendered for other users or by server-side services.
• Upgrade Mermaid to 10.9.6+ or 11.15.0+ and ensure transitive or bundled copies are also replaced.
• Temporarily disable Mermaid Gantt rendering or untrusted Mermaid rendering if upgrade timelines are delayed.
• Add input validation or content policy checks for Mermaid Gantt diagrams using broad `excludes` rules that remove the complete date range.
• Run renderers in isolated workers, containers, iframes, or browser sandboxes with CPU, memory, and timeout limits.
• Search existing user-generated content and repositories for suspicious Gantt diagrams using `excludes` before re-enabling rendering at scale.
• Monitor documentation renderers, preview services, and client-side error telemetry for hangs, crashes, or repeated rendering failures involving Mermaid Gantt diagrams.