Is there a patch available for CVE-2026-41149?

Yes, a patch is available for CVE-2026-41149. Update the affected software to the latest version immediately.

Mermaid CVE-2026-41149

Q: What is the CVSS score of CVE-2026-41149?

CVE-2026-41149 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

Q: Which versions of Mermaid are affected by CVE-2026-41149?

HTML injection in Mermaid's state diagram `classDef` parser allows escape from the SVG rendering context into the parent document DOM, affecting npm/mermaid through v11.14.0 and through v10.9.5 under…. A patch is available.

MEDIUM

Code Injection (CWE-94)

2026-05-11 https://github.com/mermaid-js/mermaid

GHSA-ghcm-xqfw-q4vr

XSS RCE Code Injection

5.3

CVSS 4.0 · Vendor: https://github.com/mermaid-js/mermaid

Severity by source

Vendor (https://github.com/mermaid-js/mermaid) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Network-delivered injection requires passive user rendering (UI:R); injection escapes SVG into parent document context (S:C); limited integrity impact only, no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (https://github.com/mermaid-js/mermaid).

CVSS VectorVendor: https://github.com/mermaid-js/mermaid

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 23:49 vuln.today

Analysis Generated

Jul 23, 2026 - 23:49 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

5.3 (MEDIUM)

CVE Published

May 11, 2026 - 19:36 cve.org

MEDIUM 5.3

CVE Published

May 11, 2026 - 19:36 nvd

MEDIUM

DescriptionCVE.org

Impact

Under the default configuration, Mermaid state diagram's classDef allow DOM injection that escapes the SVG, although <script> tags are removed, preventing XSS.

Proof-of-concept

stateDiagram-v2
  classDef xss fill:red</style></svg><style>*{x:x;y:y;overflow:visible!important;contain:none!important;transform:none!important;filter:none!important;clip-path:none!important}</style><div style="x:x;y:y;color:red;font:5em/1 monospace;display:grid;place-items:center;z-index:2147483647;width:100vw;height:100vh;position:fixed;top:0;left:0;background:black">HACKED</div><svg><style>a:b
  [*] --> A:::xss

Patches

Workarounds

If you can not update to a patched version, setting "securityLevel": "sandbox" will prevent this, by rendering the mermaid diagram in a sandboxed <iframe>.

Credits

Thanks to @zsxsoft from @KeenSecurityLab for reporting this vulnerability.

AnalysisAI

HTML injection in Mermaid's state diagram classDef parser allows escape from the SVG rendering context into the parent document DOM, affecting npm/mermaid through v11.14.0 and through v10.9.5 under the default securityLevel configuration. By embedding SVG/style-closing sequences inside CSS property values, an attacker can inject arbitrary HTML and CSS that overlays the full browser viewport - enabling UI redressing and phishing-style attacks on any platform that renders user-supplied diagrams. A public proof-of-concept is available per SSVC assessment; however, <script> tag stripping is confirmed to prevent classic XSS, and no CISA KEV active exploitation has been recorded.

Technical ContextAI

Mermaid (npm/mermaid) is a JavaScript library that parses text-based diagram definitions and renders them as inline SVG in the browser. The vulnerability resides in the state diagram renderer's handling of classDef directives, which define named CSS classes applied to diagram nodes via syntax like classDef className fill:color. The library interpolated user-supplied CSS property values directly into SVG markup as raw strings rather than through the browser's CSSOM API, allowing injection of closing tag sequences such as </style></svg> that terminate the SVG context and permit arbitrary HTML insertion into the parent document. The fix (commit 37ff937f for v11, 4e2d512b for v10) replaces string-based CSS generation with CSSOM manipulation - setting CSS properties programmatically via JavaScript rather than innerHTML-style string injection - which structurally eliminates this injection class. CWE-94 (Improper Control of Generation of Code) applies: user input is reflected into a generated markup context without sanitization.

RemediationAI

Upgrade the npm/mermaid package to v11.15.0 for consumers on the v11 branch, or to v10.9.6 for consumers on the v10 branch; these are the vendor-confirmed fixed versions per the GitHub Security Advisory. The v11 patch commit is https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056 and the v10 patch commit is https://github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3. If immediate upgrade is not feasible, set the Mermaid configuration option securityLevel to "sandbox" (documented at https://mermaid.js.org/config/schema-docs/config.html#securitylevel), which renders diagrams inside a sandboxed <iframe>, containing any injection within the iframe boundary and preventing DOM escape into the parent document. Note that sandbox mode may restrict cross-frame interactivity and some Mermaid features that rely on parent-document access - validate application behavior after enabling this option.