{“lastseen”:””,”description”:”Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, \\u003cscript\\u003e tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting \\”securityLevel\\”: \\”sandbox\\”, which prevents the issue by rendering the mermaid diagram in a sandboxed \\u003ciframe\\u003e.”,”published”:”2026-05-22T22:34:36.944Z”,”modified”:”2026-05-22T22:34:37.412Z”,”type”:”cve”,”title”:”Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection”,”source”:”GitHub_M”,”references”:”https:\/\/github.com\/mermaid-js\/mermaid\/security\/advisories\/GHSA-ghcm-xqfw-q4vr\\nhttps:\/\/github.com\/mermaid-js\/mermaid\/commit\/37ff937f1da2e19f882fd1db01235db4d01f4056\\nhttps:\/\/github.com\/mermaid-js\/mermaid\/commit\/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3″,”id”:”CVE-2026-41149″,”bulletinFamily”:””,”cwe”:[“CWE-94″],”cvelist”:null,”sourceData”:”mermaid-js mermaid \\u003e= 11.0.0-alpha.1, \\u003c 11.15.0\\nmermaid-js mermaid \\u003c 10.9.6″,”sourceHref”:””,”cvss”:{“score”:5.3,”severity”:”MEDIUM”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:P\/VC:N\/VI:L\/VA:N\/SC:L\/SI:L\/SA:L”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”mermaid”,”version”:”\\u003e= 11.0.0-alpha.1, \\u003c 11.15.0″,”vendor”:”mermaid-js”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,22,12,21,13,7,11,5],"class_list":["post-56446","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-53","tag-exploit","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n