TI-2026-50059 CVE-2026-71439 · GHSA-rhh3-jpg6-66xh
Mermaid radar diagrams are vulnerable to DoS
Priority LOW 25
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.
Vulnerabilities
15 records
TI-2026-50058 CVE-2026-71438 · GHSA-c4c3-pg64-4m4v
Mermaid configuration APIs allow prototype pollution
Priority LOW 12
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.
TI-2026-36923 CVE-2026-50159 · GHSA-6x64-9x62-f2gx
Mermaid allows CSS injection applying to sibling elements of the diagram
Priority LOW 25
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.
TI-2026-50057 CVE-2026-71437 · GHSA-3rrr-jr9j-h3q3
Mermaid Architecture diagrams are vulnerable to prototype pollution
Priority MEDIUM 62
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.
TI-2026-50056 CVE-2026-71436 · GHSA-2v8p-3f2j-5mp7
Mermaid XY Charts are vulnerable to an infinite loop DoS
Priority LOW 31
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.
TI-2026-29778 CVE-2026-41150 · GHSA-6m6c-36f7-fhxh
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
Priority MEDIUM 63
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.
TI-2026-29785 CVE-2026-41159 · GHSA-87f9-hvmw-gh4p
Mermaid: Improper sanitization of configuration leads to CSS injection
Priority LOW 25
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.
TI-2026-29777 CVE-2026-41149 · GHSA-ghcm-xqfw-q4vr
Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection
Priority MEDIUM 57
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.
TI-2026-29776 CVE-2026-41148 · GHSA-xcj9-5m2h-648r
Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection
Priority LOW 24
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.
TI-2025-34615 CVE-2025-54881 · GHSA-7rqq-prvp-x9jh
Mermaid improperly sanitizes of sequence diagram labels leading to XSS
Priority MEDIUM 63
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.
TI-2025-34614 CVE-2025-54880 · GHSA-8gwm-58g9-j8pw
Mermaid does not properly sanitize architecture diagram iconText leading to XSS
Priority MEDIUM 56
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.
TI-2024-25762 CVE-2024-38527 · GHSA-q6xv-jm4v-349h
Cross-site Scripting in ZenUML
Priority MEDIUM 58
ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams.
TI-2022-13152 CVE-2022-31108 · GHSA-x3vm-38hw-55wf
Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js
Priority MEDIUM 60
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.
TI-2021-19667 CVE-2021-43861 · GHSA-p3rp-vmj9-gv6v
Incorrect sanitisation function leads to `XSS`
Priority LOW 33
Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.
TI-2021-14247 CVE-2021-35513 · GHSA-4f6x-49g2-99fm
Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
Priority LOW 29
Mermaid before 8.11.0 allows XSS when the antiscript feature is used.