Is CVE-2026-50159 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50159 being exploited in the wild.

How severe is CVE-2026-50159?

Medium severity, with a CVSS score of 4, published 6 August 2026.

Which products and versions are affected?

mermaid (npm) SEMVER:introduced=11.0.0-alpha.1,fixed=11.16.1.

Is there a fix for CVE-2026-50159?

Yes. mermaid (npm): upgrade to 11.16.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50159 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-50159?

Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50159: Mermaid CSS injection via sibling combinators

CVE-2026-50159 · Severity: medium · CVSS 4 · Published 2026-08-06

Mermaid, a popular tool for generating charts and diagrams from text, contains a vulnerability that allows malicious diagrams to affect other parts of a web page. If an attacker can provide diagram code to be rendered on a site, they can inject styles that change the appearance of surrounding content, potentially leading to phishing attacks or hiding important information. This primarily affects developers who manually insert Mermaid diagrams into their web pages alongside other content.

Technologies: mermaid (npm). Vendors: npm.

Quick answers

Is CVE-2026-50159 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50159 being exploited in the wild.
How severe is CVE-2026-50159?: Medium severity, with a CVSS score of 4, published 6 August 2026.
Which products and versions are affected?: mermaid (npm) SEMVER:introduced=11.0.0-alpha.1,fixed=11.16.1.
Is there a fix for CVE-2026-50159?: Yes. mermaid (npm): upgrade to 11.16.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50159 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-50159?: Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mermaid (npm): upgrade to 11.16.1 or later
```
npm install mermaid@11.16.1
```

Technical details

A CSS injection vulnerability exists in Mermaid's style namespacing middleware. While the library attempts to scope CSS rules to the diagram's SVG subtree by prefixing selectors with a unique ID, it fails to account for sibling combinators ('~' and '+'). An attacker providing a malicious diagram source can use these combinators to target and restyle DOM elements adjacent to the Mermaid SVG. This can lead to UI redressing or visual phishing, though JavaScript execution is not possible. The issue is patched in versions 11.16.1 and 10.9.8.

Affected products

mermaid-js mermaid >= 11.0.0-alpha.1, < 11.16.1
mermaid-js mermaid < 10.9.8

Identifiers

CVE-2026-50159
GHSA-6x64-9x62-f2gx

Timeline

2026-08-04: disclosed
2026-08-06: advisory
2026-08-06: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.