mermaid-js

Records15All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

mermaid-js records in CISA KEV

No mermaid-js vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Mermaid 6 records MEDIUM

Records

15 records

TI-2026-29778 CVE-2026-41150 · GHSA-6m6c-36f7-fhxh

Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS

MEDIUM 63

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00384 Published 2026-05-29 Partial fix · 11.15.0, 10.9.6 CWE-835

TI-2025-34615 CVE-2025-54881 · GHSA-7rqq-prvp-x9jh

Mermaid improperly sanitizes of sequence diagram labels leading to XSS

MEDIUM 63

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00799 Published 2025-08-19 Fixed in 11.10.0, 10.9.4 CWE-79

TI-2026-50057 CVE-2026-71437 · GHSA-3rrr-jr9j-h3q3

Mermaid Architecture diagrams are vulnerable to prototype pollution

MEDIUM 62

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.

CVSS 4.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00503 Published 2026-08-06 Partial fix · 11.16.1 CWE-1321

TI-2022-13152 CVE-2022-31108 · GHSA-x3vm-38hw-55wf

Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js

MEDIUM 60

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00914 Published 2022-06-28 Fixed in 9.1.3, 9.1.2 CWE-74

TI-2024-25762 CVE-2024-38527 · GHSA-q6xv-jm4v-349h

Cross-site Scripting in ZenUML

MEDIUM 58

ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00381 Published 2024-06-26 Fixed in 3.23.25 CWE-79

TI-2026-29777 CVE-2026-41149 · GHSA-ghcm-xqfw-q4vr

Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

MEDIUM 57

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00401 Published 2026-05-22 Partial fix · 11.15.0, 10.9.6 CWE-94

TI-2025-34614 CVE-2025-54880 · GHSA-8gwm-58g9-j8pw

Mermaid does not properly sanitize architecture diagram iconText leading to XSS

MEDIUM 56

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0041 Published 2025-08-19 Fixed in 11.10.0 CWE-79

TI-2021-19667 CVE-2021-43861 · GHSA-p3rp-vmj9-gv6v

Incorrect sanitisation function leads to `XSS`

LOW 33

Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00938 Published 2021-12-30 Fixed in 8.13.8 CWE-20

TI-2026-50056 CVE-2026-71436 · GHSA-2v8p-3f2j-5mp7

Mermaid XY Charts are vulnerable to an infinite loop DoS

LOW 31

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00581 Published 2026-08-06 Fixed in 10.9.8, 11.16.1 CWE-1325

TI-2021-14247 CVE-2021-35513 · GHSA-4f6x-49g2-99fm

Mermaid before 8.11.0 allows XSS when the antiscript feature is used.

LOW 29

Mermaid before 8.11.0 allows XSS when the antiscript feature is used.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01018 Published 2021-06-27 Fixed in 8.11.0 CWE-79

TI-2026-50059 CVE-2026-71439 · GHSA-rhh3-jpg6-66xh

Mermaid radar diagrams are vulnerable to DoS

LOW 25

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00528 Published 2026-08-06 Partial fix · 11.16.1 CWE-1322

TI-2026-36923 CVE-2026-50159 · GHSA-6x64-9x62-f2gx

Mermaid allows CSS injection applying to sibling elements of the diagram

LOW 25

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00603 Published 2026-08-06 Partial fix · 10.9.8, 11.16.1 CWE-94

TI-2026-29785 CVE-2026-41159 · GHSA-87f9-hvmw-gh4p

Mermaid: Improper sanitization of configuration leads to CSS injection

LOW 25

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00486 Published 2026-05-29 Partial fix · 11.15.0, 10.9.6 CWE-94

TI-2026-29776 CVE-2026-41148 · GHSA-xcj9-5m2h-648r

Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection

LOW 24

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00338 Published 2026-05-22 Partial fix · 11.15.0, 10.9.6 CWE-94

TI-2026-50058 CVE-2026-71438 · GHSA-c4c3-pg64-4m4v

Mermaid configuration APIs allow prototype pollution

LOW 12

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.

CVSS 4.0LOW 2.4 Local High privileges User interaction EPSS 0.00353 Published 2026-08-06 Partial fix · 10.9.8, 11.16.1 CWE-1321

Open these records in search →