Is CVE-2026-41149 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41149 being exploited in the wild.

How severe is CVE-2026-41149?

Medium severity, with a CVSS score of 4, published 22 May 2026.

Which products and versions are affected?

mermaid (npm) SEMVER:introduced=11.0.0-alpha.1,fixed=11.15.0.

Is there a fix for CVE-2026-41149?

Yes. mermaid (npm): upgrade to 11.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41149 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41149?

Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41149: Mermaid HTML injection in state diagram classDef

CVE-2026-41149 · Severity: medium · CVSS 4 · Published 2026-05-22

Mermaid is a popular library used to generate charts and diagrams from text. A vulnerability in how it handles state diagrams allows an attacker to inject malicious HTML code into a page. While the library attempts to block scripts, an attacker could still alter the visual appearance of the page or overlay fake content to deceive users.

Technologies: mermaid (npm). Vendors: npm.

Quick answers

Is CVE-2026-41149 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41149 being exploited in the wild.
How severe is CVE-2026-41149?: Medium severity, with a CVSS score of 4, published 22 May 2026.
Which products and versions are affected?: mermaid (npm) SEMVER:introduced=11.0.0-alpha.1,fixed=11.15.0.
Is there a fix for CVE-2026-41149?: Yes. mermaid (npm): upgrade to 11.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41149 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41149?: Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mermaid (npm): upgrade to 11.15.0 or later
```
npm install mermaid@11.15.0
```

Technical details

An HTML injection vulnerability exists in Mermaid's state diagram implementation due to improper sanitization of the `classDef` directive. By crafting a specific diagram string, an attacker can use CSS and HTML tags to escape the SVG container and inject arbitrary DOM elements into the host page. While Mermaid's default configuration removes `<script>` tags (preventing direct XSS), an attacker can still perform UI redressing or CSS-based attacks. The vulnerability is exploitable if a user views a diagram containing malicious `classDef` definitions. Patches are available in versions 11.15.0 and 10.9.6; a workaround is to set `securityLevel` to `sandbox`.

Affected products

mermaid-js mermaid >= 11.0.0-alpha.1, <= 11.14.0
mermaid-js mermaid <= 10.9.5

Identifiers

CVE-2026-41149
GHSA-ghcm-xqfw-q4vr

Timeline

2026-05-11: disclosed
2026-05-11: advisory
2026-05-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.