Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS

보통 5.3CVE-2026-41150 · GHSA-6m6c-36f7-fhxh · Published 29/05/2026 · updated 21/07/2026

요약

CVE-2026-41150은(는) mermaid (mermaid project), mermaid에 영향을 주는 보통 (CVSS 5.3) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.38%, 전체 취약점의 32.7%보다 높음.
조치: 11.15.0, 10.9.6 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
mermaid mermaid_project	`≥ 11.0.0, < 11.15.0< 10.9.6`	`11.15.010.9.6`
mermaid npm	`≥ 11.0.0-alpha.1, < 11.15.0< 10.9.6`	`11.15.010.9.6`

Description

Impact

Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates.

Example:

gantt
  excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday
  DoS :2025-01-01, 1d

mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram).

Patches

This has been patched in:

Workarounds

There are no workarounds available without updating to a newer version of mermaid.

NVD description

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates. mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram). This vulnerability is fixed in 10.9.6 and 11.15.0.

References

mermaid-js/mermaid security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-41150 · ADVISORY
mermaid-js/mermaid commit a59ea56 · WEB
mermaid-js/mermaid commit faafb5d · WEB
mermaid-js/mermaid · PACKAGE
mermaid-js/mermaid release [email protected] · WEB
mermaid-js/mermaid release v10.9.6 · WEB

mermaid의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mermaid

mermaid_project

≥ 11.0.0, < 11.15.0< 10.9.6

11.15.010.9.6

mermaid

npm

≥ 11.0.0-alpha.1, < 11.15.0< 10.9.6

11.15.010.9.6

Description

Impact

Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates.

Example:

gantt
  excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday
  DoS :2025-01-01, 1d

mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram).

Patches

This has been patched in:

Workarounds

There are no workarounds available without updating to a newer version of mermaid.

NVD description

mermaid의 다른 취약점

모두 보기 →