PT-2026-39885 · Mermaid Js+3 · Mermaid+1

Matejsmycka · Published 2026-05-11 · Updated 2026-05-23 · CVE-2026-41148

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Mermaid versions prior to 10.9.6 Mermaid versions 11.0.0-alpha.1 through 11.14.0

Description Improper sanitization in the state diagram and other diagram types that route user-controlled style strings through the createCssStyles parser allows for CSS injection. The system captures classDef values using an unrestricted regex that matches everything up to a newline. This value flows unsanitized through the addStyleClass() function into createCssStyles() and is assigned to style.innerHTML. A closing brace (}) in the value can terminate the generated CSS selector, allowing subsequent text to be interpreted as a new CSS rule on the page. This can lead to page defacement, user tracking via url() callbacks, and DOM attribute exfiltration.

Recommendations Update to version 10.9.6 for versions prior to 10.9.6. Update to version 11.15.0 for versions 11.0.0-alpha.1 through 11.14.0. As a temporary workaround, set securityLevel to sandbox to render diagrams in a sandboxed .

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-41148

GHSA-XCJ9-5M2H-648R

Affected Products

Mermaid

Node-Mermaid

References · 16

• https://cve.org/CVERecord?id=CVE-2026-41148 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-41148 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41148 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41148 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xcj9-5m2h-648r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41148 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41148 · Vendor Advisory
• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r · Note
• https://github.com/mermaid-js/mermaid/commit/8fead23c59166b7bab6a39eac81acebee2859102 · Note
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6 · Note
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0 · Note
• https://github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f · Note
• https://github.com/mermaid-js/mermaid · Note
• https://t.me/CVEtracker/54691 · Telegram Post
• https://twitter.com/CVEnew/status/2058155761642156423 · Twitter Post