# mermaid (npm) vulnerabilities

14 known vulnerabilities (1 high, 11 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://www.npmjs.com/package/mermaid

## Advisories (14)

### [CVE-2026-71439](https://cve.now/CVE-2026-71439): Mermaid radar diagrams are vulnerable to DoS

- Severity: Medium 5.3
- Published: Aug 6, 2026
- Affected: from 11.6.0, fixed in 11.16.1.

### [CVE-2026-71438](https://cve.now/CVE-2026-71438): Mermaid configuration APIs allow prototype pollution

- Severity: Low 2.4
- Published: Aug 6, 2026
- Affected: from 11.0.0-alpha.1, fixed in 11.16.1; fixed in 10.9.8.

### [CVE-2026-50159](https://cve.now/CVE-2026-50159): Mermaid allows CSS injection applying to sibling elements of the diagram

- Severity: Medium 5.3
- Published: Aug 6, 2026
- Affected: from 11.0.0-alpha.1, fixed in 11.16.1; fixed in 10.9.8.

### [CVE-2026-71437](https://cve.now/CVE-2026-71437): Mermaid Architecture diagrams are vulnerable to prototype pollution

- Severity: Medium 6.5
- Published: Aug 6, 2026
- Affected: from 11.5.0, fixed in 11.16.1.

### [CVE-2026-71436](https://cve.now/CVE-2026-71436): Mermaid XY Charts are vulnerable to an infinite loop DoS

- Severity: Medium 5.3
- Published: Aug 6, 2026
- Affected: from 10.6.0, fixed in 10.9.8; from 11.0.0-alpha.1, fixed in 11.16.1.

### [CVE-2026-41150](https://cve.now/CVE-2026-41150): Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS

- Severity: Medium 5.3
- Published: May 29, 2026
- Affected: from 11.0.0-alpha.1, fixed in 11.15.0; fixed in 10.9.6.

### [CVE-2026-41159](https://cve.now/CVE-2026-41159): Mermaid: Improper sanitization of configuration leads to CSS injection

- Severity: Medium 5.3
- Published: May 29, 2026
- Affected: from 11.0.0-alpha.1, fixed in 11.15.0; fixed in 10.9.6.

### [CVE-2026-41149](https://cve.now/CVE-2026-41149): Mermaid: Improper sanitization of \`classDef\` in state diagrams leads to HTML injection

- Severity: Medium 5.3
- Published: May 22, 2026
- Affected: from 11.0.0-alpha.1, fixed in 11.15.0; fixed in 10.9.6.

### [CVE-2026-41148](https://cve.now/CVE-2026-41148): Mermaid: Improper sanitization of \`classDefs\` in diagrams leads to CSS injection

- Severity: Medium 5.3
- Published: May 22, 2026
- Affected: from 11.0.0-alpha.1, fixed in 11.15.0; fixed in 10.9.6.

### [CVE-2025-54881](https://cve.now/CVE-2025-54881): Mermaid improperly sanitizes of sequence diagram labels leading to XSS

- Severity: Medium 5.3
- Published: Aug 19, 2025
- Affected: from 11.0.0-alpha.1, fixed in 11.10.0; from 10.9.0-rc.1, fixed in 10.9.4.

### [CVE-2025-54880](https://cve.now/CVE-2025-54880): Mermaid does not properly sanitize architecture diagram iconText leading to XSS

- Severity: Medium 5.1
- Published: Aug 19, 2025
- Affected: from 11.1.0, fixed in 11.10.0.

### [CVE-2022-31108](https://cve.now/CVE-2022-31108): Arbitrary \`CSS\` injection into the generated graph affecting the container HTML in mermaid.js

- Severity: Medium 4.1
- Published: Jun 28, 2022
- Affected: from 8.0.0, fixed in 9.1.2.

### [CVE-2021-43861](https://cve.now/CVE-2021-43861): Incorrect sanitisation function leads to \`XSS\`

- Severity: High 7.2
- Published: Dec 30, 2021
- Affected: fixed in 8.13.8.

### [CVE-2021-35513](https://cve.now/CVE-2021-35513): Mermaid before 8.11.0 allows XSS when the antiscript feature is used.

- Severity: Unrated
- Published: Jun 27, 2021
- Affected: fixed in 8.11.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/mermaid
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.