PT-2026-39886 · Mermaid Js+3 · Mermaid+1

Zsxsoft · Published 2026-05-11 · Updated 2026-05-23 · CVE-2026-41149

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Mermaid versions prior to 10.9.6 Mermaid versions 11.0.0-alpha.1 through 11.14.0

Description Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Under the default configuration, the classDef directive in state diagrams allows HTML injection that escapes the SVG context, leading to DOM injection. While <script> tags are stripped to prevent cross-site scripting (XSS), the issue still allows for the injection of arbitrary HTML elements into the Document Object Model (DOM), which is the programming interface for HTML and XML documents.

Recommendations Update to version 10.9.6. Update to version 11.15.0. As a temporary workaround, set securityLevel to sandbox to render diagrams in a sandboxed <iframe>.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-41149

GHSA-GHCM-XQFW-Q4VR

Affected Products

Mermaid

Node-Mermaid

References · 16

• 🔥 https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-41149 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41149 · Security Note
• https://ubuntu.com/security/CVE-2026-41149 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ghcm-xqfw-q4vr · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41149 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41149 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41149 · Security Note
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6 · Note
• https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056 · Note
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0 · Note
• https://github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3 · Note
• https://github.com/mermaid-js/mermaid · Note
• https://t.me/CVEtracker/54696 · Telegram Post
• https://twitter.com/CVEnew/status/2058155756185375166 · Twitter Post