mermaid-js vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20221
3. 20241
4. 20252
5. 20269

Newest CVEs

• CVE-2026-71439

  Mermaid radar diagrams are vulnerable to DoS

  mermaid-js · mermaid

  Medium5.3
• CVE-2026-71438

  Mermaid configuration APIs allow prototype pollution

  mermaid-js · mermaid

  Low2.4
• CVE-2026-50159

  Mermaid allows CSS injection applying to sibling elements of the diagram

  mermaid-js · mermaid

  Medium5.3
• CVE-2026-71437

  Mermaid Architecture diagrams are vulnerable to prototype pollution

  mermaid-js · mermaid

  Medium6.5
• CVE-2026-71436

  Mermaid XY Charts are vulnerable to an infinite loop DoS

  mermaid-js · mermaid

  Medium5.3
• CVE-2026-41150

  Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS

  mermaid-js · mermaid

  Medium5.3
• CVE-2026-41159

  Mermaid: Improper sanitization of configuration leads to CSS injection

  mermaid-js · mermaid

  Medium5.3
• CVE-2026-41149

  Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

  mermaid-js · mermaid

  Medium5.3
• CVE-2026-41148

  Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection

  mermaid-js · mermaid

  Medium5.3
• CVE-2025-54881

  Mermaid improperly sanitizes of sequence diagram labels leading to XSS

  mermaid-js · mermaid

  Medium5.3