Skip to main content
cve.nowby Sazabi
← npm
npmPackage

mermaid

14 known vulnerabilities (1 high, 11 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
14 · 1 high, 11 medium, 1 low
Registry
npm

Advisories 14

  • CVE-2026-71439Medium 5.3

    Mermaid radar diagrams are vulnerable to DoS

    Affected: from 11.6.0, fixed in 11.16.1.

  • Mermaid configuration APIs allow prototype pollution

    Affected: from 11.0.0-alpha.1, fixed in 11.16.1; fixed in 10.9.8.

  • CVE-2026-50159Medium 5.3

    Mermaid allows CSS injection applying to sibling elements of the diagram

    Affected: from 11.0.0-alpha.1, fixed in 11.16.1; fixed in 10.9.8.

  • CVE-2026-71437Medium 6.5

    Mermaid Architecture diagrams are vulnerable to prototype pollution

    Affected: from 11.5.0, fixed in 11.16.1.

  • CVE-2026-71436Medium 5.3

    Mermaid XY Charts are vulnerable to an infinite loop DoS

    Affected: from 10.6.0, fixed in 10.9.8; from 11.0.0-alpha.1, fixed in 11.16.1.

  • CVE-2026-41150Medium 5.3

    Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS

    Affected: from 11.0.0-alpha.1, fixed in 11.15.0; fixed in 10.9.6.

  • CVE-2026-41159Medium 5.3

    Mermaid: Improper sanitization of configuration leads to CSS injection

    Affected: from 11.0.0-alpha.1, fixed in 11.15.0; fixed in 10.9.6.

  • CVE-2026-41149Medium 5.3

    Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

    Affected: from 11.0.0-alpha.1, fixed in 11.15.0; fixed in 10.9.6.

  • CVE-2026-41148Medium 5.3

    Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection

    Affected: from 11.0.0-alpha.1, fixed in 11.15.0; fixed in 10.9.6.

  • CVE-2025-54881Medium 5.3

    Mermaid improperly sanitizes of sequence diagram labels leading to XSS

    Affected: from 11.0.0-alpha.1, fixed in 11.10.0; from 10.9.0-rc.1, fixed in 10.9.4.

  • CVE-2025-54880Medium 5.1

    Mermaid does not properly sanitize architecture diagram iconText leading to XSS

    Affected: from 11.1.0, fixed in 11.10.0.

  • CVE-2022-31108Medium 4.1

    Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js

    Affected: from 8.0.0, fixed in 9.1.2.

  • Incorrect sanitisation function leads to `XSS`

    Affected: fixed in 8.13.8.

  • Mermaid before 8.11.0 allows XSS when the antiscript feature is used.

    Affected: fixed in 8.11.0.