mermaid-js/mermaid Security Advisories | GitStock

medium2026-08-06

CVE-2026-71439-Mermaid radar diagrams are vulnerable to DoS

GHSA-rhh3-jpg6-66xh

low2026-08-06

CVE-2026-71438-Mermaid configuration APIs allow prototype pollution

GHSA-c4c3-pg64-4m4v

medium2026-08-06

CVE-2026-50159-Mermaid allows CSS injection applying to sibling elements of the diagram

GHSA-6x64-9x62-f2gx

medium2026-08-06

CVE-2026-71437-Mermaid Architecture diagrams are vulnerable to prototype pollution

GHSA-3rrr-jr9j-h3q3

medium2026-08-06

CVE-2026-71436-Mermaid XY Charts are vulnerable to an infinite loop DoS

GHSA-2v8p-3f2j-5mp7

medium2026-05-11

CVE-2026-41159-Mermaid: Improper sanitization of configuration leads to CSS injection

GHSA-87f9-hvmw-gh4p

medium2026-05-11

CVE-2026-41150-Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS

GHSA-6m6c-36f7-fhxh

medium2026-05-11

CVE-2026-41149-Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

GHSA-ghcm-xqfw-q4vr

medium2026-05-11

CVE-2026-41148-Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection

GHSA-xcj9-5m2h-648r

medium2025-08-19

CVE-2025-54881-Mermaid improperly sanitizes sequence diagram labels leading to XSS

GHSA-7rqq-prvp-x9jh

medium2025-08-19

CVE-2025-54880-Mermaid does not properly sanitize architecture diagram iconText leading to XSS

GHSA-8gwm-58g9-j8pw

high2024-10-22

Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify

GHSA-m4gq-x24j-jpmf

medium2022-07-05

CVE-2022-31108-Possible inject arbitrary `CSS` into the generated graph affecting the container HTML

GHSA-x3vm-38hw-55wf

high2022-01-06

CVE-2021-43861-Incorrect sanitisation function leads to `XSS` in mermaid

GHSA-p3rp-vmj9-gv6v