CVE-2026-41159
Description
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options. The injected CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping, applying styles to all page elements. Global at-rules (@font-face, @keyframes, @counter-style) are also injectable as stylis hoists them to top level. This allows page defacement and DOM attribute exfiltration via CSS :has() selectors. This vulnerability is fixed in 10.9.6 and 11.15.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mermaidnpm | >= 11.0.0-alpha.1, < 11.15.0 | 11.15.0 |
mermaidnpm | < 10.9.6 | 10.9.6 |
Affected products
6- Range: <= 10.9.5
- osv-coords4 versionspkg:apk/chainguard/langfuse-2-workerpkg:apk/chainguard/langfuse-fips-2-workerpkg:apk/chainguard/librechatpkg:npm/mermaid
< 2.95.12-r23+ 3 more
- (no CPE)range: < 2.95.12-r23
- (no CPE)range: < 2.95.12-r25
- (no CPE)range: < 0.8.4-r7
- (no CPE)range: >= 11.0.0-alpha.1, < 11.15.0
Patches
Vulnerability mechanics
References
9- github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aahttps://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76nvdPatchWEB
- github.com/advisories/GHSA-87f9-hvmw-gh4pghsaADVISORY
- github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4pnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-41159ghsaADVISORY
- github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aaghsaWEB
- github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76ghsaWEB
- github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0ghsaWEB
- github.com/mermaid-js/mermaid/releases/tag/mermaid@11.15.0nvdRelease NotesWEB
- github.com/mermaid-js/mermaid/releases/tag/v10.9.6nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.