PT-2026-39887 · Mermaid · Mermaid

Twavesx · Published 2026-05-11 · Updated 2026-05-29 · CVE-2026-41150

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Mermaid versions 11.14.0 and earlier Mermaid versions prior to 10.9.6

Description A denial-of-service issue occurs when rendering gantt charts if the excludes attribute is used to exclude all dates. While mermaid.parse is not affected, the issue is triggered when calling the ganttDb.getTasks() function during diagram rendering.

Recommendations Update to version 11.15.0. Update to version 10.9.6.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-41150

GHSA-6M6C-36F7-FHXH

Affected Products

Mermaid

References · 9

• 🔥 https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh · Exploit
• https://github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6 · Patch
• https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e · Patch
• https://osv.dev/vulnerability/GHSA-6m6c-36f7-fhxh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41150 · Security Note
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6 · Note
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0 · Note
• https://github.com/mermaid-js/mermaid · Note
• https://twitter.com/dailycve/status/2053985863286079819 · Twitter Post