Mmermaid-js

Products

Exploited and recent CVEs

• CVE-2026-71439 Medium 5.3 Mermaid radar diagrams are vulnerable to DoS 0.5%
• CVE-2026-71438 Low 2.4 Mermaid configuration APIs allow prototype pollution 0.4%
• CVE-2026-50159 Medium 5.3 Mermaid allows CSS injection applying to sibling elements of the diagram 0.6%
• CVE-2026-71437 Medium 6.5 Mermaid Architecture diagrams are vulnerable to prototype pollution 0.5%
• CVE-2026-71436 Medium 5.3 Mermaid XY Charts are vulnerable to an infinite loop DoS 0.6%
• CVE-2026-41150 Medium 5.3 Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS 0.4%
• CVE-2026-41159 Medium 5.3 Mermaid: Improper sanitization of configuration leads to CSS injection 0.5%
• CVE-2026-41149 Medium 5.3 Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection 0.4%
• CVE-2026-41148 Medium 5.3 Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection 0.3%
• CVE-2025-54881 Medium 5.3 Mermaid improperly sanitizes of sequence diagram labels leading to XSS 0.8%
• CVE-2025-54880 Medium 5.1 Mermaid does not properly sanitize architecture diagram iconText leading to XSS 0.4%
• CVE-2024-38527 Medium 5.4 Cross-site Scripting in ZenUML 0.4%
• CVE-2022-31108 Medium 4.1 Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js 0.9%
• CVE-2021-43861 High 7.2 Incorrect sanitisation function leads to `XSS` 0.9%