Mermaid allows CSS injection applying to sibling elements of the diagram

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-50159 · Microsoft / collected KEV context

EUVD-2026-54243

GHSA-6x64-9x62-f2gx

cve-program · CVE-2026-50159

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed
• https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e
• https://github.com/mermaid-js/mermaid/releases/tag/[email protected]
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

euvd · EUVD-2026-54243

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed
• https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e
• https://github.com/mermaid-js/mermaid/releases/tag/[email protected]
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

nvd · CVE-2026-50159

• https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed
• https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/releases/tag/[email protected]
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8
• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx

osv · GHSA-6x64-9x62-f2gx

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed
• https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e
• https://github.com/mermaid-js/mermaid
• https://github.com/mermaid-js/mermaid/releases/tag/[email protected]
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

No related operational record is retained in the current change model.