CVE-2026-41149

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, <script> tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed <iframe>.

• CWE-94

• https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056
• https://github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3
• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr
• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr

Published

May 22, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41143YesWiki is a wiki system written in PHP. Prior to version 4.…8.8
• CVE-2026-41144F´ (F Prime) is a framework that enables development and dep…9.8
• CVE-2026-41145MinIO is a high-performance object storage system. Starting …8.2
• CVE-2026-41146facil.io is a C micro-framework for web applications. Prior …8.7
• CVE-2026-41147NukeViet CMS is a multi Content Management System. Versions …8.7
• CVE-2026-41148Mermaid is a JavaScript tool that uses Markdown-inspired tex…5.3
• CVE-2026-4115A vulnerability was detected in PuTTY 0.83. Affected is the …3.7
• CVE-2026-41150Mermaid is a JavaScript tool that uses Markdown-inspired tex…5.3
• CVE-2026-41153In JetBrains Junie before 252.549.29 command execution was p…9.8
• CVE-2026-41154Software installed and run as a non-privileged user may caus…7.8
• CVE-2026-41155An attacker could cooperatively pass data from one secure GP…5.5
• CVE-2026-41156Software installed and run as a non-privileged user may cond…7.7