Mermaid: Improper sanitization of configuration leads to CSS injection

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-41159 · CVE overview and exploitation status

EUVD-2026-33324

GHSA-87f9-hvmw-gh4p

cve-program · CVE-2026-41159

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p
• https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa
• https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76
• https://github.com/mermaid-js/mermaid/releases/tag/[email protected]
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6

euvd · EUVD-2026-33324

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p
• https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa
• https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76
• https://github.com/mermaid-js/mermaid/releases/tag/[email protected]
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6

nvd · CVE-2026-41159

• https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa
• https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76
• https://github.com/mermaid-js/mermaid/releases/tag/[email protected]
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6
• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p

osv · GHSA-87f9-hvmw-gh4p

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p
• https://nvd.nist.gov/vuln/detail/CVE-2026-41159
• https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa
• https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76
• https://github.com/mermaid-js/mermaid
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0
• https://github.com/mermaid-js/mermaid/releases/tag/[email protected]
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6

No related changes are available here.