Is there a patch available for CVE-2026-41148?

Yes, a patch is available for CVE-2026-41148. Update the affected software to the latest version immediately.

Mermaid CVE-2026-41148

Q: What is the CVSS score of CVE-2026-41148?

CVE-2026-41148 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Code Injection (CWE-94)

2026-05-11 https://github.com/mermaid-js/mermaid

GHSA-xcj9-5m2h-648r

RCE Code Injection

5.3

CVSS 4.0 · Vendor: https://github.com/mermaid-js/mermaid

Severity by source

Vendor (https://github.com/mermaid-js/mermaid) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-accessible with no auth (PR:N), requires victim to view the diagram page (UI:R), and scope changes (S:C) as injected CSS escapes the diagram component to affect the host page; CSS exfiltration yields low confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (https://github.com/mermaid-js/mermaid).

CVSS VectorVendor: https://github.com/mermaid-js/mermaid

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 23:50 vuln.today

Analysis Generated

Jul 23, 2026 - 23:50 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

5.3 (MEDIUM)

CVE Published

May 11, 2026 - 19:36 nvd

MEDIUM

DescriptionCVE.org

Details

The state diagram and any other diagram type that routes user-controlled style strings through createCssStyles parser for Mermaid v11.14.0 and earlier captures classDef values with an unrestricted regex:

jison

// packages/mermaid/src/diagrams/state/parser/stateDiagram.jison:83
<CLASSDEFID>[^\n]*   { this.popState(); return 'CLASSDEF_STYLEOPTS' }

The value passes unsanitized through addStyleClass() -> createCssStyles() -> style.innerHTML (mermaidAPI.ts:418). A } in the value closes the generated CSS selector, and everything after becomes a new CSS rule on the page.

PoC

stateDiagram-v2
      classDef x }*{ background-image: url("http://media.giphy.com/media/SggILpMXO7Xt6/giphy.gif")}

Live demo: <https://mermaid.live/edit#pako:eNpFjzFvgzAQhf-KdVNbEcBgMHhtlkqtOnSJKi8ONsYKBmRMlRTx3-skanvTfbp7996t0IxSAYPZC6_2Rmgn7O4rQ00v5nmvWnRG29OKjqI5aTcug9wZK7RiaHH9A4fO-4kliVXSiFibqbvEzWjvnHxo_fI6vR3e6cGXyX2qTcvhcYMItDMSmHeLisAqZ8UVYeUDQhx8p6ziwEIrhTtx4MNVM4nhcxztrywE0h2wVvRzoGWS_z_8rahBKvcckntgmN5OAFvhDIzUNCZZQXCR5nVaZkUEF2BVFpOcEkoxxhUuyRbB980yjStapKHqoKFlhvPtB7BFZEU>

Patches

This has been patched in:

Workarounds

Setting "securityLevel": "sandbox" will prevent this, by rendering the mermaid diagram in a sandboxed <iframe>.

Impact

Enables page defacement, user tracking via url() callbacks, and DOM attribute exfiltration via CSS :has() selectors.

AnalysisAI

CSS injection in Mermaid's diagram rendering engine (npm/mermaid v11.14.0 and earlier, v10.9.5 and earlier) allows attackers who can supply diagram input to inject arbitrary CSS rules into the host page. The flaw exists because classDef style strings are captured by an unrestricted Jison regex and written unsanitized to style.innerHTML, enabling page defacement, user tracking via CSS url() callbacks, and DOM attribute exfiltration via CSS :has() selectors. A public proof-of-concept with a live demo is confirmed in the GHSA advisory; no CISA KEV listing at time of analysis.

Technical ContextAI

Mermaid uses a Jison-based parser for state diagrams (stateDiagram.jison:83) where the rule <CLASSDEFID>[^\n]* captures any content on the line following a classDef keyword without restriction. The captured value flows unsanitized through addStyleClass() → createCssStyles() → assignment to style.innerHTML in mermaidAPI.ts:418. Because the string is interpolated directly into a CSS rule, injecting a } character terminates the generated selector block and allows arbitrary CSS rules to be appended to the host page's stylesheet. This affects state diagrams and any other diagram type that routes user-controlled style strings through createCssStyles. CWE-94 (Improper Control of Generation of Code) is the root cause class; the specific manifestation is CSS injection rather than script execution. The affected packages are pkg:npm/mermaid across both the v10 and v11 release branches.

RemediationAI

Upgrade to Mermaid v11.15.0 (commit e9b0f34d8d82a6260077764ee45e1d7d90957a0f) or v10.9.6 (commit 8fead23c59166b7bab6a39eac81acebee2859102) per the release pages at https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0 and https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6. If immediate patching is not feasible, set "securityLevel": "sandbox" in the Mermaid configuration (documented at https://mermaid.js.org/config/schema-docs/config.html#securitylevel), which renders diagrams inside a sandboxed <iframe> and fully prevents injected CSS from reaching the host page; note this changes rendering behavior and may break integrations that depend on parent-page stylesheet access. No other confirmed compensating controls are available from the advisory data.