GHSA-ghcm-xqfw-q4vr
NoneCVSS
—
EPSS
—
Published
May 11, 2026
CISA due date
—
The record
Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | mermaid | 0 | 10.9.6 |
| npm | mermaid | 11.0.0-alpha.1 | 11.15.0 |
Related vulnerabilities
- CVE-2026-41149 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify… Same vulnerability
- CVE-2026-41150 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify… Also affects mermaid
- CVE-2026-41159 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify… Also affects mermaid
- CVE-2026-41148 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify… Also affects mermaid
- GHSA-87f9-hvmw-gh4p Mermaid: Improper sanitization of configuration leads to CSS injection Also affects mermaid
- GHSA-6m6c-36f7-fhxh Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS Also affects mermaid
- GHSA-xcj9-5m2h-648r Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection Also affects mermaid
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94