CVE-2026-50159
Mermaid allows CSS injection applying to sibling elements of the diagram
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1.
| CWE | CWE-94 |
| Vendor | mermaid-js |
| Product | mermaid |
| Published | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for mermaid-js mermaid
Be the first to know when new unknown vulnerabilities affecting mermaid-js mermaid are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
mermaid-js / mermaid
< 10.9.8 >= 11.0.0-alpha.1, < 11.16.1
References
github.com: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx github.com: https://github.com/mermaid-js/mermaid/pull/8022 github.com: https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed github.com: https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e github.com: https://github.com/mermaid-js/mermaid/releases/tag/[email protected] github.com: https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8