Executive brief
beautiful-mermaid is a library used to render Mermaid diagrams into SVG images for display on websites. A security flaw in versions before 0.1.3 allows an attacker to create a specially crafted diagram that, when viewed by a user, executes malicious scripts in their web browser. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive information from the website where the diagram is displayed.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in beautiful-mermaid due to improper neutralization of input during SVG generation. Specifically, user-controlled values from Mermaid 'style' and 'classDef' directives (such as fill, stroke, stroke-width, and color) are interpolated directly into SVG attribute values without sufficient escaping. An attacker can provide a crafted diagram that breaks out of the attribute context to inject arbitrary SVG elements or attributes, such as an 'onload' event handler. When the resulting SVG is rendered in a browser, the injected script executes in the context of the embedding origin. This issue is fixed in version 0.1.3 by applying XML escaping to these properties.
Affected products
- lukilabs beautiful-mermaid < 0.1.3
Timeline
- 2026-01-29: patched: Fix merged in PR #8 and released in v0.1.3
- 2026-02-13: advisory: CVE-2026-26226 published