Mermaid CVE-2026-41149

Exploitation requires three concurrent conditions: (1) the target application renders Mermaid state diagrams under the default securityLevel configuration - not "sandbox" or "strict" mode; (2) untrusted users can supply or influence the diagram source text that is subsequently rendered in a victim's browser; and (3) the victim's browser renders the page containing the malicious diagram. Exploitation is NOT possible when securityLevel is set to "sandbox" (iframe isolation prevents SVG-to-parent DOM escape) or when diagram source is fully controlled by trusted parties. JavaScript execution is blocked by existing <script> tag stripping, limiting impact to HTML/CSS DOM injection without script execution. The SSVC 'not automatable' designation confirms that mass exploitation is not achievable without a platform-level delivery mechanism targeting specific rendering contexts.

The CVSS 4.0 score of 5.3 (Medium) is reasonable given AV:N/PR:N (no authentication barrier) offset by UI:P (passive victim interaction required to render the diagram) and partial impact metrics. EPSS at 0.04% (14th percentile) reflects very low current exploitation probability, consistent with the absence of a CISA KEV listing. SSVC categorizes exploitation as 'poc' and automatable as 'no,' meaning this vulnerability cannot be mass-exploited without a social or platform delivery mechanism - the attacker must induce a specific victim to render a malicious diagram. The real-world risk is highest for collaborative platforms that render user-supplied Mermaid source (wikis, documentation sites, CI/CD dashboards, GitHub-adjacent tools) where the injected full-viewport overlay enables convincing phishing overlays or clickjacking. The 'RCE' tag present in the source metadata is not supported by the advisory - this is DOM/HTML injection only, and JavaScript execution via script tags is confirmed blocked. Despite the partial impact ceiling, the visual severity of the PoC (full-page black overlay reading 'HACKED') makes this a credible social engineering vector on affected platforms.

An attacker submits a crafted stateDiagram-v2 containing a classDef whose CSS value embeds </style></svg> to escape SVG context, followed by a full-viewport <div> overlay styled with position:fixed; z-index:2147483647 that covers the entire page with attacker-controlled content. When a victim views the page on a wiki or documentation platform that renders user-submitted Mermaid diagrams using the default securityLevel, the injected HTML renders over all page content, enabling phishing credential capture or UI redressing. A working proof-of-concept producing this effect is published in the GitHub Security Advisory GHSA-ghcm-xqfw-q4vr.