Mermaid-js vulnerabilities

Products

• Mermaid 13

Newest

• mermaid-js mermaid Mermaid radar diagrams are vulnerable to DoS CVE-2026-71439 Fix available 5.3 MediumAugust 6, 2026
• mermaid-js mermaid Mermaid configuration APIs allow prototype pollution CVE-2026-71438 Fix available 2.4 LowAugust 6, 2026
• mermaid-js mermaid Mermaid allows CSS injection applying to sibling elements of the diagram CVE-2026-50159 Fix available 5.3 MediumAugust 6, 2026
• mermaid-js mermaid Mermaid Architecture diagrams are vulnerable to prototype pollution CVE-2026-71437 Fix available 6.5 MediumAugust 6, 2026
• mermaid-js mermaid Mermaid XY Charts are vulnerable to an infinite loop DoS CVE-2026-71436 Fix available 5.3 MediumAugust 6, 2026
• mermaid-js mermaid Mermaid: Improper sanitization of configuration leads to CSS injection CVE-2026-41159 Fix available 5.3 MediumMay 11, 2026
• mermaid-js mermaid Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS CVE-2026-41150 Fix available 5.3 MediumMay 11, 2026
• mermaid-js mermaid Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection CVE-2026-41149 Fix available 5.3 MediumMay 11, 2026
• mermaid-js mermaid Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection CVE-2026-41148 Fix available 5.3 MediumMay 11, 2026
• mermaid-js mermaid Mermaid improperly sanitizes of sequence diagram labels leading to XSS CVE-2025-54881 Fix available 5.3 MediumAugust 19, 2025
• mermaid-js mermaid Mermaid does not properly sanitize architecture diagram iconText leading to XSS CVE-2025-54880 Fix available 5.1 MediumAugust 19, 2025
• mermaid-js zenuml-core Cross-site Scripting in ZenUML CVE-2024-38527 Fix available 5.4 MediumJune 26, 2024
• mermaid-js mermaid Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js CVE-2022-31108 Fix available 4.1 MediumJune 28, 2022
• mermaid-js mermaid Incorrect sanitisation function leads to `XSS` CVE-2021-43861 Fix available 7.2 HighDecember 30, 2021