Mermaid EUVD-2026-33325

The vulnerability requires three concurrent conditions: (1) the target application uses the mermaid npm package at a vulnerable version (10.x < 10.9.6 or 11.0.0-alpha.1 through 11.14.0); (2) the application invokes the rendering path that calls ganttDb.getTasks() - mermaid.parse() alone is NOT sufficient; and (3) the attacker can supply or influence Mermaid diagram syntax that reaches the renderer, specifically a gantt block with an excludes directive that covers all seven weekday names or an equivalent all-encompassing combination. No authentication is required by the library itself - the authentication barrier depends entirely on what access controls the host application places on diagram submission. The DoS effect is scoped to the rendering thread or browser tab: it does not affect system availability beyond the rendering process. Deployments where diagram content is exclusively authored by trusted users, or where pre-render input validation rejects all-day-excluded gantt charts, are not exploitable.

The CVSS 4.0 score of 5.3 with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L accurately characterizes the attack as network-reachable, low-complexity, and requiring only passive user interaction (a user or automated job rendering the diagram). Impact is bounded to availability at Low severity - this causes a hung rendering thread or frozen browser tab, not a crash of the underlying host or data exfiltration. EPSS of 0.04% (14th percentile) is very low, indicating minimal observed exploitation activity, consistent with the absence of a CISA KEV entry. However, the advisory itself contains a trivial three-line PoC, meaning the barrier to reproduction is near-zero. Real-world risk is asymmetric: negligible for deployments where diagram content is authored and controlled by trusted users, but meaningful for any SaaS or collaboration platform that renders untrusted user-supplied Mermaid syntax without pre-render sanitization. There is no CVSS 3.x vector provided in the input - the 4.0 vector is the authoritative scoring source.

An attacker with posting access to a platform that renders user-supplied Mermaid diagrams - such as a GitHub wiki, GitLab issue, Confluence page, or a custom documentation tool - submits a Gantt chart block containing 'excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday'. The minimal PoC published in the advisory is sufficient. When any user or automated pipeline renders the page, the Mermaid rendering engine calls ganttDb.getTasks(), enters fixTaskDates, and spins indefinitely with no CPU yield, hanging the browser tab on client-side platforms or consuming a server worker thread until the process is killed or times out.