| Mermaid radar diagrams are vulnerable to DoSCVE-2026-71439 · GHSA-RHH3-JPG6-66XH |
mermaidRed Hat OpenShift AI (RHOAI)/rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Mermaid configuration APIs allow prototype pollutionCVE-2026-71438 · GHSA-C4C3-PG64-4M4V |
mermaidRed Hat Build of Podman Desktop/rh-podman-desktop.git |
npmRed Hat |
Low
|
Fix reported |
|
| Mermaid allows CSS injection applying to sibling elements of the diagramCVE-2026-50159 · GHSA-6X64-9X62-F2GX |
mermaidRed Hat OpenShift AI (RHOAI)/rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Mermaid Architecture diagrams are vulnerable to prototype pollutionCVE-2026-71437 · GHSA-3RRR-JR9J-H3Q3 |
mermaidRed Hat Build of Podman Desktop/rh-podman-desktop.git |
npmRed Hat |
Medium
|
Fix reported |
|
| Mermaid XY Charts are vulnerable to an infinite loop DoSCVE-2026-71436 · GHSA-2V8P-3F2J-5MP7 |
mermaid |
npm |
Medium
|
Fix reported |
|
| Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injectionCVE-2026-41148 · GHSA-XCJ9-5M2H-648R |
mermaidRed Hat Build of Podman Desktop/rh-podman-desktop.git |
npmRed Hat |
Medium
|
Fix reported |
|
| Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injectionCVE-2026-41149 · GHSA-GHCM-XQFW-Q4VR |
mermaidRed Hat Build of Podman Desktop/rh-podman-desktop.git |
npmRed Hat |
Medium
|
Fix reported |
|
| Mermaid: Improper sanitization of configuration leads to CSS injectionCVE-2026-41159 · GHSA-87F9-HVMW-GH4P |
mermaidRed Hat Build of Podman Desktop/rh-podman-desktop.git |
npmRed Hat |
Medium
|
Fix reported |
|
| Mermaid Gantt Charts are vulnerable to an Infinite Loop DoSCVE-2026-41150 · GHSA-6M6C-36F7-FHXH |
mermaidRed Hat Build of Podman Desktop/rh-podman-desktop.git |
npmRed Hat |
Medium
|
Fix reported |
|
| Mermaid does not properly sanitize architecture diagram iconText leading to XSSCVE-2025-54880 · GHSA-8GWM-58G9-J8PW |
mermaid |
npm |
Medium
|
Fix reported |
|
| Mermaid improperly sanitizes sequence diagram labels leading to XSSCVE-2025-54881 · GHSA-7RQQ-PRVP-X9JH |
mermaid |
npm |
Medium
|
Fix reported |
|
| Incorrect sanitisation function leads to `XSS` in mermaidCVE-2021-43861 · GHSA-P3RP-VMJ9-GV6V |
mermaid |
npm |
High
|
Fix reported |
|
| Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurifyGHSA-M4GQ-X24J-JPMF |
mermaid |
npm |
High
|
Fix reported |
|
| Possible inject arbitrary `CSS` into the generated graph affecting the container HTMLCVE-2022-31108 · GHSA-X3VM-38HW-55WF |
mermaid |
npm |
Medium
|
Fix reported |
|
| Cross-site Scripting in MermaidCVE-2021-35513 · GHSA-4F6X-49G2-99FM |
mermaid |
npm |
Medium
|
Fix reported |
|
| Cross-Site Scripting in mermaidGHSA-W32G-5HQP-GG6Q |
mermaid |
npm |
High
|
Fix reported |
|
