CVE-2026-50159

Received Received - Intake

CSS Injection in Mermaid Diagram Tool

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-50159

Affected Vendors & Products

Vendor	Product	Version / Range
mermaid	mermaid	to 10.9.8 (inc)
mermaid	mermaid	to 11.16.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

Mermaid is a JavaScript tool for creating diagrams using text. Prior to versions 10.9.8 and 11.16.1, it had a vulnerability where attackers could inject arbitrary CSS into rendered pages by supplying malicious diagram text with specific class or id names. This could alter the appearance or behavior of unrelated page elements.

Detection Guidance

To detect this vulnerability, check the installed version of Mermaid in your environment. If you are using Mermaid versions prior to 10.9.8 or 11.16.1, the system is vulnerable. Run commands like 'npm list mermaid' or 'yarn list mermaid' to verify the installed version.

Impact Analysis

If you use Mermaid in your application, an attacker could manipulate the visual layout or behavior of your webpage by injecting CSS. This might lead to phishing attacks, misleading users, or disrupting functionality. Users of affected versions are at risk if they render untrusted diagram text.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized visual modifications to web interfaces, potentially violating integrity or confidentiality requirements under GDPR or HIPAA. Affected systems may fail to protect user data or maintain accurate representations, leading to regulatory violations.

Mitigation Strategies

Immediately upgrade Mermaid to version 10.9.8 or 11.16.1 or later. If using npm, run 'npm update mermaid' or 'npm install mermaid@latest'. If using yarn, run 'yarn upgrade mermaid' or 'yarn add mermaid@latest'. Remove any untrusted diagram inputs that may contain malicious class or id names.

Hi! I’m here to help you understand CVE-2026-50159. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70