What’s Vulnerable › Products

mermaid-js mermaid vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your mermaid-js mermaid version is affected

Latest mermaid-js mermaid vulnerabilities

• CVE-2026-71439 — Mermaid radar diagrams are vulnerable to DoS (CVSS 5.3)
• CVE-2026-71438 — Mermaid configuration APIs allow prototype pollution (CVSS 2.4)
• CVE-2026-71437 — Mermaid Architecture diagrams are vulnerable to prototype pollution (CVSS 6.5)
• CVE-2026-71436 — Mermaid XY Charts are vulnerable to an infinite loop DoS (CVSS 5.3)
• CVE-2026-50159 — Mermaid allows CSS injection applying to sibling elements of the diagram (CVSS 5.3)
• CVE-2026-41159 — Mermaid: Improper sanitization of configuration leads to CSS injection (CVSS 5.3)
• CVE-2026-41150 — Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS (CVSS 5.3)
• CVE-2026-41149 — Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection (CVSS 5.3)
• CVE-2026-41148 — Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection (CVSS 5.3)
• CVE-2025-54881 — Mermaid improperly sanitizes of sequence diagram labels leading to XSS (CVSS 5.3)
• CVE-2025-54880 — Mermaid does not properly sanitize architecture diagram iconText leading to XSS (CVSS 6.1)
• CVE-2022-31108 — Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js (CVSS 6.1)
• CVE-2021-43861 — Incorrect sanitisation function leads to `XSS` (CVSS 5.4)
• CVE-2021-35513 — (CVSS 6.1)