EUVD-2026-33324
GHSA-87f9-hvmw-gh4p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no privileges; victim must render the diagram (UI:R); CSS escapes diagram scope to host page (S:C); limited confidentiality via :has() exfiltration (C:L) and integrity via defacement (I:L); no availability impact.
Primary rating from Vendor (https://github.com/mermaid-js/mermaid).
CVSS VectorVendor: https://github.com/mermaid-js/mermaid
Lifecycle Timeline
4DescriptionCVE.org
Impact
Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options.
Live demo: mermaid.live
Example code:
%%{init: {"fontFamily": "x;a{b} :not(&){background:green !important} c{d}"}}%%
flowchart LR
A --> BThe injected CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping, applying styles to all page elements. Global at-rules (@font-face, @keyframes, @counter-style) are also injectable as stylis hoists them to top level.
This allows page defacement and DOM attribute exfiltration via CSS :has() selectors.
Patches
- v11.15.0 (see 64769738d5b59211e1decb471ffbaca8afec51aa)
- v10.9.6 (see a9d9f0d8eb790349121508688cd338253fd80d76)
Workarounds
If you can't upgrade mermaid, you can set the secure config value in the mermaid config to avoid allowing diagrams to modify fontFamily, themeCSS, altFontFamily, and themeVariables.
Setting "securityLevel": "sandbox" will also prevent this.
Credits
Reported by @zsxsoft on behalf of @KeenSecurityLab
AnalysisAI
CSS scoping bypass in Mermaid's default configuration allows injected styles to escape the diagram SVG container and apply globally to the host page via the fontFamily, themeCSS, and altFontFamily initialization options. Affected are npm/mermaid versions up to 10.9.5 and 11.0.0-alpha.1 through 11.14.0 when rendered with default settings - covering any web application that renders user-supplied diagram definitions, such as wikis and documentation platforms. An attacker who can influence diagram initialization parameters can achieve page defacement and DOM attribute exfiltration via CSS :has() selectors; a public proof-of-concept demo exists on mermaid.live, though no CISA KEV listing or widespread exploitation is recorded, and the EPSS of 0.05% (15th percentile) confirms low current exploitation activity.
Technical ContextAI
Mermaid (pkg:npm/mermaid) is a JavaScript diagramming library that uses the stylis CSS preprocessor to scope diagram styles under a unique SVG ID such as #mermaid-xxx. The root cause is CWE-94 (Improper Control of Generation of Code): stylis treats & as a scope reference that resolves to the diagram's root selector, and when Mermaid compiles user-supplied strings from fontFamily, themeCSS, or altFontFamily options, it previously did not enforce that &-containing selectors remain bounded by the diagram namespace. The pseudo-class :not(&) in stylis matches any element that is not the diagram root - effectively the entire host page - allowing global style injection. Additionally, global CSS at-rules (@font-face, @keyframes, @counter-style) are hoisted to the document top level by stylis, further widening the injection surface. The fix (commits 64769738 and a9d9f0d8) introduces a stylis middleware in mermaidAPI.ts that iterates every compiled CSS rule's props array and prepends the diagram namespace to any selector not already starting with it, ensuring :not(&) and similar constructs can never resolve outside the SVG element.
RemediationAI
Upgrade to mermaid v11.15.0 (v11 line) or v10.9.6 (v10 line), both confirmed fixed releases per the GitHub advisory GHSA-87f9-hvmw-gh4p; patch commits are https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa (v11) and https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76 (v10). If immediate upgrade is not feasible, set the secure configuration array in your Mermaid config to block user modification of fontFamily, themeCSS, altFontFamily, and themeVariables - note this disables legitimate diagram-level styling customization. Alternatively, set "securityLevel": "sandbox" to render diagrams inside an isolated iframe, which fully prevents CSS escape to the host page; this may affect certain diagram rendering features and requires proper iframe CSP configuration to be effective. See https://mermaid.js.org/config/schema-docs/config.html#securitylevel for securityLevel documentation.
Same weakness CWE-94 – Code Injection
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today