CVE-2026-41159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options. The injected CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping, applying styles to all page elements. Global at-rules (@font-face, @keyframes, @counter-style) are also injectable as stylis hoists them to top level. This allows page defacement and DOM attribute exfiltration via CSS :has() selectors. This vulnerability is fixed in 10.9.6 and 11.15.0.

• CWE-94

• https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa
• https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.15.0Release Notes
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6Release Notes
• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4pThird Party Advisory

Published

May 29, 2026

Last Modified

Jul 21, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41153In JetBrains Junie before 252.549.29 command execution was p…9.8
• CVE-2026-41154Software installed and run as a non-privileged user may caus…7.8
• CVE-2026-41155An attacker could cooperatively pass data from one secure GP…5.5
• CVE-2026-41156Software installed and run as a non-privileged user may cond…7.7
• CVE-2026-41157A web page that contains unusual WebGPU content loaded into …9.8
• CVE-2026-41158Software installed and run as a non-privileged user may cond…7.8
• CVE-2026-4116Improper handling of Unicode encoding in SonicWall SMA1000 s…7.2
• CVE-2026-41160EspoCRM is an open source customer relationship management a…4.3
• CVE-2026-41161Sync-in Server is a secure, open-source platform for file st…5.3
• CVE-2026-41163bubblewrap is a low-level unprivileged sandboxing tool. From…8.7
• CVE-2026-41164nuts-node is the reference implementation of the Nuts specif…4.4
• CVE-2026-41166OpenRemote is an open-source internet-of-things platform. Pr…7