# CVE-2022-31108: Mermaid.js CSS injection via theme variables

Source: https://junglewise.ai/threats/cve-2022-31108-mermaid-js-css-injection-via-theme-variables  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-07-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-31108 · Severity: low · CVSS 3.1 · Published 2022-07-05

Mermaid.js is a JavaScript library used to create diagrams and flowcharts in web applications. An attacker can inject arbitrary CSS into generated diagrams to manipulate the styling of elements outside the diagram or exfiltrate sensitive information from the page (such as form field values) using specially crafted CSS selectors. This could allow unauthorized access to confidential data or manipulation of user interactions on affected web pages.

Technologies: [mermaid (npm)](https://junglewise.ai/threats/technologies/mermaid). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-31108 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-31108 being exploited in the wild.

**How severe is CVE-2022-31108?** Low severity, with a CVSS score of 3.1, published 5 July 2022.

**Which products and versions are affected?** mermaid (npm) SEMVER:introduced=8.0.0,fixed=9.1.2.

**Is there a fix for CVE-2022-31108?** Yes. mermaid (npm): upgrade to 9.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-31108 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-31108?** Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mermaid (npm): upgrade to 9.1.2 or later

  ```sh
  npm install mermaid@9.1.2
  ```


## Technical details

The vulnerability is a CSS injection flaw in Mermaid.js versions 8.0.0 through 9.1.1 affecting the theme configuration handling. The root cause is insufficient sanitization of user-supplied theme variables (such as textColor, fontFamily, and fontSize) before embedding them directly into CSS blocks generated by the getStyles() function and mermaidAPI.js. An attacker with the ability to control diagram initialization parameters (via theme variables in graph definitions) can break out of the intended CSS scope and inject arbitrary selectors and rules. The attack vector is network-based with no authentication required, but user interaction (viewing a page containing the malicious diagram) is necessary. Exploitation enables information disclosure via CSS attribute selectors paired with URL-based side channels, DOM manipulation, and clickjacking attacks. The vulnerability was fixed in version 9.1.2 by properly escaping user input before CSS insertion.

## Affected products

- Mermaid.js Mermaid 8.0.0 through 9.1.1

## Identifiers

- CVE-2022-31108
- GHSA-x3vm-38hw-55wf

## Timeline

- 2022-06-28: disclosed
- 2022-07-05: advisory
- 2022-07-05: patched: Version 9.1.2 released

## References

- [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-x3vm-38hw-55wf](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-x3vm-38hw-55wf)

## Related threats

- [Mermaid radar diagrams denial of service via unchecked ticks input](https://junglewise.ai/threats/cve-2026-71439-mermaid-radar-diagrams-denial-of-service-via-unchecked-ticks)
- [Mermaid prototype pollution in configuration APIs](https://junglewise.ai/threats/cve-2026-71438-mermaid-prototype-pollution-in-configuration-apis)
- [Mermaid prototype pollution in architecture-beta diagrams](https://junglewise.ai/threats/cve-2026-71437-mermaid-prototype-pollution-in-architecture-beta-diagrams)
- [Mermaid infinite loop in XY Charts axis processing](https://junglewise.ai/threats/cve-2026-71436-mermaid-infinite-loop-in-xy-charts-axis-processing)
- [Mermaid CSS injection via sibling combinators](https://junglewise.ai/threats/cve-2026-50159-mermaid-css-injection-via-sibling-combinators)