beautiful-mermaid versions prior to 0.1.3 contain an SVG attribute injection issue that can lead to cross-site scripting (XSS) when rendering attacker-controlled Mermaid diagrams.
CVSS 4.0MEDIUM 5.3·Network·No auth·User interaction·EPSS 0.00573·Published 2026-02-13·Fixed in 0.1.3CWE-79