CVE-2026-41149
Description
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed .
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mermaidnpm | >= 11.0.0-alpha.1, < 11.15.0 | 11.15.0 |
mermaidnpm | < 10.9.6 | 10.9.6 |
Affected products
5- Range: <= 10.9.5
- osv-coords4 versionspkg:apk/chainguard/langfuse-2-workerpkg:apk/chainguard/langfuse-fips-2-workerpkg:apk/chainguard/librechatpkg:npm/mermaid
< 2.95.12-r23+ 3 more
- (no CPE)range: < 2.95.12-r23
- (no CPE)range: < 2.95.12-r25
- (no CPE)range: < 0.8.4-r7
- (no CPE)range: >= 11.0.0-alpha.1, < 11.15.0
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-ghcm-xqfw-q4vrghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-41149ghsaADVISORY
- github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056nvdWEB
- github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3nvdWEB
- github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0ghsaWEB
- github.com/mermaid-js/mermaid/releases/tag/v10.9.6ghsaWEB
- github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vrnvdWEB
- mermaid.js.org/config/schema-docs/config.htmlghsaWEB
News mentions
0No linked articles in our index yet.