Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

MEDIUM 5.3CVE-2026-41149 · GHSA-ghcm-xqfw-q4vr · Published 22/05/2026 · updated 23/07/2026

In short

CVE-2026-41149 is a MEDIUM (CVSS 5.3) vulnerability affecting mermaid.
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.5% of all vulnerabilities.
Fix: update to 11.15.0, 10.9.6 or later.

Package	Affected versions	Patched versions
mermaid npm	`≥ 11.0.0-alpha.1, < 11.15.0< 10.9.6`	`11.15.010.9.6`

Description

Impact

Under the default configuration, Mermaid state diagram's classDef allow DOM injection that escapes the SVG, although <script> tags are removed, preventing XSS.

Proof-of-concept

stateDiagram-v2
  classDef xss fill:red</style></svg><style>*{x:x;y:y;overflow:visible!important;contain:none!important;transform:none!important;filter:none!important;clip-path:none!important}</style><div style="x:x;y:y;color:red;font:5em/1 monospace;display:grid;place-items:center;z-index:2147483647;width:100vw;height:100vh;position:fixed;top:0;left:0;background:black">HACKED</div><svg><style>a:b
  [*] --> A:::xss

Patches

Workarounds

If you can not update to a patched version, setting "securityLevel": "sandbox" will prevent this, by rendering the mermaid diagram in a sandboxed <iframe>.

Credits

Thanks to @zsxsoft from @KeenSecurityLab for reporting this vulnerability.

NVD description

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, <script> tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed <iframe>.

References

mermaid-js/mermaid security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-41149 · ADVISORY
mermaid-js/mermaid commit 37ff937 · WEB
mermaid-js/mermaid commit 4e2d512 · WEB
mermaid-js/mermaid · PACKAGE
mermaid-js/mermaid release [email protected] · WEB
mermaid-js/mermaid release v10.9.6 · WEB
mermaid.js.org/config/schema-docs/config.html · WEB

More vulnerabilities in mermaid

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mermaid

npm

≥ 11.0.0-alpha.1, < 11.15.0< 10.9.6

11.15.010.9.6