Mermaid CVE-2026-41159

Exploitation requires that the target application renders user-controllable Mermaid diagram content under the default Mermaid configuration, specifically without securityLevel: sandbox and without the secure config option enabled. The attacker must be able to influence the fontFamily, themeCSS, or altFontFamily initialization parameters - either through diagram frontmatter syntax (%%{init: {...}}%%) embedded in user-supplied diagram text, or via application-level configuration that accepts user input for these fields. A victim user must passively view (render) the page containing the malicious diagram in a browser (CVSS UI:P). Exploitation is blocked if: the application sanitizes or strips diagram initialization options before rendering; securityLevel: sandbox is set (isolates rendering to an iframe); or the secure array config is set (prevents user override of the vulnerable parameters). The CVSS vector PR:N reflects that no account or authentication is required to supply diagram content in typical default-configured deployments.

The vendor-assigned CVSS 4.0 score of 5.3 (Medium) correctly captures the core risk profile: network-reachable (AV:N), low complexity (AC:L), no privileges required (PR:N), but passive user interaction needed (UI:P - a victim must render the diagram). EPSS at 0.05% (15th percentile) is very low and the vulnerability is not in the CISA KEV, indicating no confirmed widespread exploitation. The 'RCE' tag present in the source intelligence is a mislabel - the commit diff and advisory description confirm impact is CSS injection enabling page defacement and DOM attribute exfiltration, not arbitrary code execution; security teams should not escalate based on that tag. Real-world risk is meaningful specifically for platforms that render user-supplied Mermaid diagrams with default configuration (wikis, collaborative documentation, Markdown renderers), where the CSS breakout can enable phishing overlays, UI redressing, or CSS-based side-channel data leakage. Risk is substantially mitigated by the securityLevel: sandbox workaround. The delta between CVSS 5.3 and actual organizational risk depends almost entirely on whether user-controlled diagram input reaches a renderer in default mode.

An attacker submits a malicious Mermaid diagram containing a crafted fontFamily initialization parameter - for example %%{init: {"fontFamily": "x;a{b} :not(&){background:green !important} c{d}"}}%% - to a wiki or documentation platform that renders user-supplied diagram definitions. When any user views the page, the injected CSS bypasses stylis scoping and applies globally, defacing the page or using CSS :has() selectors to exfiltrate DOM attributes such as hidden form values or data attributes to an attacker-controlled endpoint. A working proof-of-concept is publicly accessible via the mermaid.live demo linked in the advisory.