CVE-2026-50159
Description
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
CVE-2026-50159 NameCVE-2026-50159 DescriptionMermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page,…
CVE-2026-50159
| Name | CVE-2026-50159 |
| Description | Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| node-mermaid (PTS) | bullseye | 8.7.0+ds+~cs27.17.17-3+deb11u2 | vulnerable |
| forky | 9.2.2+~2.0.0-1 | vulnerable | |
| sid | 9.2.2+~2.0.0-2 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| node-mermaid | source | (unstable) | (unfixed) |
Notes
https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx
Fixed by: https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed (mermaid@11.16.1)
Fixed by: https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e (v10.9.7)
Apply commands
https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gxFixed by: https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed (mermaid@11.16.1)Fixed by: https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e (v10.9.7)OS impact
Debian Affected 3 releases
| Version | Status | Fixed in |
|---|---|---|
| sid | Affected | — |
| forky | Affected | — |
| bullseye | Affected | — |
References
- https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed
- https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e
- https://github.com/mermaid-js/mermaid/pull/8022
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1
- https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx
- https://github.com/mermaid-js/mermaid
- https://security-tracker.debian.org/tracker/CVE-2026-50159
CWEs
CWE-94
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.