Is there a patch available for CVE-2026-41150?

Yes, a patch is available for CVE-2026-41150. Update the affected software to the latest version immediately.

Mermaid CVE-2026-41150

Q: What is the CVSS score of CVE-2026-41150?

CVE-2026-41150 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33325 MEDIUM

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-05-11 https://github.com/mermaid-js/mermaid

GHSA-6m6c-36f7-fhxh

Denial Of Service

5.3

CVSS 4.0 · Vendor: https://github.com/mermaid-js/mermaid

Severity by source

Vendor (https://github.com/mermaid-js/mermaid) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted diagram content requiring no authentication (PR:N), but a user or automated job must render it (UI:R); only availability is affected, scoped to the rendering process (A:L, S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (https://github.com/mermaid-js/mermaid).

CVSS VectorVendor: https://github.com/mermaid-js/mermaid

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 23:49 vuln.today

Analysis Generated

Jul 23, 2026 - 23:49 vuln.today

CVSS changed

May 29, 2026 - 15:22 NVD

5.3 (MEDIUM)

CVE Published

May 11, 2026 - 19:36 cve.org

MEDIUM 5.3

CVE Published

May 11, 2026 - 19:36 nvd

MEDIUM

DescriptionCVE.org

Impact

Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates.

Example:

gantt
  excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday
  DoS :2025-01-01, 1d

mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram).

Patches

This has been patched in:

Workarounds

There are no workarounds available without updating to a newer version of mermaid.

AnalysisAI

Infinite-loop denial-of-service in Mermaid's Gantt chart renderer affects npm/mermaid v11.14.0 and earlier (including 11.x alpha/beta) and all 10.x releases prior to v10.9.6, allowing any party who can supply diagram syntax to a rendering pipeline to permanently hang the rendering thread or browser tab. The attack surface is specifically platforms that accept user-supplied Mermaid content and call the render path - wikis, issue trackers, documentation tools, and SaaS products embedding Mermaid. No public exploit is independently confirmed beyond the minimal reproducer included in the advisory itself; EPSS sits at 0.04% (14th percentile), consistent with no observed mass exploitation and no CISA KEV listing.

Technical ContextAI

Mermaid (pkg:npm/mermaid) is a JavaScript diagramming library that generates diagrams from text syntax, widely embedded in platforms such as GitHub, GitLab, Confluence, and Obsidian. The root cause is CWE-835 (Loop with Unreachable Exit Condition). The Gantt renderer's fixTaskDates function in ganttDb.js iterates a date forward until it lands on a day not listed in the excludes exclusion set. When all seven weekday names (monday through sunday) or equivalent combinations (e.g., 'weekends' plus individual weekdays) are listed in the excludes attribute, every candidate date is excluded and the loop has no reachable exit condition - it spins indefinitely. The vulnerability is latent in mermaid.parse() but only triggered when ganttDb.getTasks() is invoked, which occurs during diagram rendering. The patch (commits faafb5d and a59ea56 for v11.15.0 and v10.9.6 respectively) adds a hard cap of 10,000 iterations before throwing a descriptive error, converting the infinite loop into a bounded, catchable failure.

RemediationAI

Upgrade to mermaid v11.15.0 (11.x branch) or v10.9.6 (10.x branch); both are vendor-confirmed patched releases available on npm. The underlying fix is present in commits faafb5d49106dd32c367f3882505f2dd625aa30e (v11.15.0) and a59ea56174712ee5430dfd5bc877cb5151f501a6 (v10.9.6). The vendor explicitly states no workaround exists without upgrading. For teams unable to upgrade immediately, a compensating control is to validate the excludes field on the server side before passing diagram content to the renderer - specifically, reject any Gantt diagram where the union of excluded values covers all seven days (monday, tuesday, wednesday, thursday, friday, saturday, sunday, weekends). This validation is imperfect because it does not cover exhaustive specific-date exclusions and adds custom parsing logic that must be maintained, so it is strictly inferior to patching. Server-side rendering pipelines can additionally wrap the render call in a timeout and kill the worker on expiry, limiting the blast radius to a single request rather than an entire worker process.