Skip to contentMermaid-js Mermaid vulnerabilities
- mermaid-js mermaidMermaid radar diagrams are vulnerable to DoSCVE-2026-71439Fix available5.3 Medium
- mermaid-js mermaidMermaid configuration APIs allow prototype pollutionCVE-2026-71438Fix available2.4 Low
- mermaid-js mermaidMermaid allows CSS injection applying to sibling elements of the diagramCVE-2026-50159Fix available5.3 Medium
- mermaid-js mermaidMermaid Architecture diagrams are vulnerable to prototype pollutionCVE-2026-71437Fix available6.5 Medium
- mermaid-js mermaidMermaid XY Charts are vulnerable to an infinite loop DoSCVE-2026-71436Fix available5.3 Medium
- mermaid-js mermaidMermaid: Improper sanitization of configuration leads to CSS injectionCVE-2026-41159Fix available5.3 Medium
- mermaid-js mermaidMermaid Gantt Charts are vulnerable to an Infinite Loop DoSCVE-2026-41150Fix available5.3 Medium
- mermaid-js mermaidMermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injectionCVE-2026-41149Fix available5.3 Medium
- mermaid-js mermaidMermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injectionCVE-2026-41148Fix available5.3 Medium
- mermaid-js mermaidMermaid improperly sanitizes of sequence diagram labels leading to XSSCVE-2025-54881Fix available5.3 Medium
- mermaid-js mermaidMermaid does not properly sanitize architecture diagram iconText leading to XSSCVE-2025-54880Fix available5.1 Medium
- mermaid-js mermaidArbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.jsCVE-2022-31108Fix available4.1 Medium
- mermaid-js mermaidIncorrect sanitisation function leads to `XSS`CVE-2021-43861Fix available7.2 High