Mermaid CVE-2026-71436

The vulnerability is triggered exclusively when rendering a Mermaid XY chart diagram type (xychart or xychart-beta) with an x-axis range where the start and end values are identical (e.g., x-axis 1 --> 1). Exploitation requires that the attacker can supply diagram text that is processed by the Mermaid rendering engine - either through a browser-side rendering path or a server-side Node.js rendering pipeline. The library itself imposes no authentication; whether an attacker can reach the renderer depends on the consuming application's access controls. Exploitation is limited to availability impact only (DoS); no code execution, data exfiltration, or integrity violation is possible. All other diagram types (flowchart, sequence, etc.) are unaffected. Environments that do not process user-supplied XY chart input are not at risk.

No CVSS vector was provided by NVD or the vendor advisory, so severity must be inferred. The attack requires only a crafted diagram string - no credentials, no network adjacency beyond what the application exposes, and no prior foothold. For applications that expose Mermaid rendering to untrusted users (documentation platforms, wikis, chat tools, SaaS editors), exploitation is fully automatable: one malformed diagram causes a process or tab crash within seconds. The impact is purely availability; no confidentiality or integrity compromise is possible. The public POC lowers the exploitation bar to zero skill required. EPSS data is unavailable at time of analysis. The absence of a CISA KEV listing suggests no confirmed widespread active exploitation, but the trivial POC and broad deployment of Mermaid in developer-facing tools represents genuine real-world risk for affected application categories. Risk is context-dependent: applications that do not accept untrusted diagram input are not affected at the library level.

An attacker submits the three-line Mermaid diagram xychart\n x-axis 1 --> 1\n line [1, 2] to any web application, documentation platform, or API that accepts and renders user-supplied Mermaid diagrams. The rendering engine immediately enters an infinite loop in setXAxisRangeData(), consuming all available JavaScript heap memory and crashing the browser tab or Node.js process within seconds. The exact POC is reproduced verbatim in the public advisory, requiring no exploitation skill.