Is CVE-2026-41159 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41159 being exploited in the wild.

How severe is CVE-2026-41159?

Medium severity, with a CVSS score of 4, published 29 May 2026.

Which products and versions are affected?

mermaid (npm) SEMVER:introduced=11.0.0-alpha.1,fixed=11.15.0.

Is there a fix for CVE-2026-41159?

Yes. mermaid (npm): upgrade to 11.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41159 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41159?

Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41159: Mermaid CSS injection via configuration options

CVE-2026-41159 · Severity: medium · CVSS 4 · Published 2026-05-29

Mermaid is a popular JavaScript-based diagramming and charting tool. A vulnerability in its configuration handling allows an attacker to inject malicious styling (CSS) into a web page where a diagram is displayed. This can lead to the unauthorized modification of the page's appearance or the potential theft of sensitive information displayed on the same page.

Technologies: mermaid (npm). Vendors: npm.

Quick answers

Is CVE-2026-41159 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41159 being exploited in the wild.
How severe is CVE-2026-41159?: Medium severity, with a CVSS score of 4, published 29 May 2026.
Which products and versions are affected?: mermaid (npm) SEMVER:introduced=11.0.0-alpha.1,fixed=11.15.0.
Is there a fix for CVE-2026-41159?: Yes. mermaid (npm): upgrade to 11.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41159 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41159?: Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mermaid (npm): upgrade to 11.15.0 or later
```
npm install mermaid@11.15.0
```

Technical details

A CSS injection vulnerability exists in Mermaid due to improper sanitization of configuration options including 'fontFamily', 'themeCSS', and 'altFontFamily'. An attacker can exploit the 'stylis' library's scope reference handling (using the '&' character) to escape the intended '#mermaid-xxx' CSS scoping. By using selectors like ':not(&)', an attacker can apply arbitrary styles to all elements on the hosting page, enabling page defacement or data exfiltration via CSS ':has()' selectors. The vulnerability is patched in versions 11.15.0 and 10.9.6; workarounds include enabling 'secure' mode or setting 'securityLevel' to 'sandbox'.

Affected products

mermaid-js mermaid >= 11.0.0-alpha.1, <= 11.14.0; <= 10.9.5

Identifiers

CVE-2026-41159
GHSA-87f9-hvmw-gh4p

Timeline

2026-05-11: disclosed
2026-05-11: advisory
2026-05-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.