GHSA-6m6c-36f7-fhxh
Medium · 5.3CVSS
5.3
EPSS
—
Published
May 11, 2026
CISA due date
—
The record
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | mermaid | 0 | 10.9.6 |
| npm | mermaid | 11.0.0-alpha.1 | 11.15.0 |
Related vulnerabilities
- CVE-2026-41150 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify… Same vulnerability
- CVE-2026-41159 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify… Also affects mermaid
- CVE-2026-41148 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify… Also affects mermaid
- CVE-2026-41149 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify… Also affects mermaid
- GHSA-87f9-hvmw-gh4p Mermaid: Improper sanitization of configuration leads to CSS injection Also affects mermaid
- GHSA-ghcm-xqfw-q4vr Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection Also affects mermaid
- GHSA-xcj9-5m2h-648r Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection Also affects mermaid
- CVE-2026-110354 HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of… CWE-835