TI-2026-29778 CVE-2026-41150 · GHSA-6m6c-36f7-fhxh
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
Priority MEDIUM 63
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.
mermaid-js
Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
mermaid-js records in CISA KEVNo mermaid-js vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records in Mermaid · all components
TI-2022-13152 CVE-2022-31108 · GHSA-x3vm-38hw-55wf
Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js
Priority MEDIUM 60
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.
TI-2025-34614 CVE-2025-54880 · GHSA-8gwm-58g9-j8pw
Mermaid does not properly sanitize architecture diagram iconText leading to XSS
Priority MEDIUM 56
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.
TI-2021-19667 CVE-2021-43861 · GHSA-p3rp-vmj9-gv6v
Incorrect sanitisation function leads to `XSS`
Priority LOW 33
Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.
TI-2021-14247 CVE-2021-35513 · GHSA-4f6x-49g2-99fm
Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
Priority LOW 29
Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
TI-2026-29785 CVE-2026-41159 · GHSA-87f9-hvmw-gh4p
Mermaid: Improper sanitization of configuration leads to CSS injection
Priority LOW 25
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.