# CVE-2026-50159: Mermaid CSS injection via sibling combinators

Source: https://junglewise.ai/threats/cve-2026-50159-mermaid-css-injection-via-sibling-combinators  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-08-06  
License: CC BY 4.0 with a link back

CVE-2026-50159 · Severity: medium · CVSS 4 · Published 2026-08-06

Mermaid, a popular tool for generating charts and diagrams from text, contains a vulnerability that allows malicious diagrams to affect other parts of a web page. If an attacker can provide diagram code to be rendered on a site, they can inject styles that change the appearance of surrounding content, potentially leading to phishing attacks or hiding important information. This primarily affects developers who manually insert Mermaid diagrams into their web pages alongside other content.

Technologies: [mermaid (npm)](https://junglewise.ai/threats/technologies/mermaid). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-50159 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50159 being exploited in the wild.

**How severe is CVE-2026-50159?** Medium severity, with a CVSS score of 4, published 6 August 2026.

**Which products and versions are affected?** mermaid (npm) SEMVER:introduced=11.0.0-alpha.1,fixed=11.16.1.

**Is there a fix for CVE-2026-50159?** Yes. mermaid (npm): upgrade to 11.16.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50159 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50159?** Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mermaid (npm): upgrade to 11.16.1 or later

  ```sh
  npm install mermaid@11.16.1
  ```


## Technical details

A CSS injection vulnerability exists in Mermaid's style namespacing middleware. While the library attempts to scope CSS rules to the diagram's SVG subtree by prefixing selectors with a unique ID, it fails to account for sibling combinators ('~' and '+'). An attacker providing a malicious diagram source can use these combinators to target and restyle DOM elements adjacent to the Mermaid SVG. This can lead to UI redressing or visual phishing, though JavaScript execution is not possible. The issue is patched in versions 11.16.1 and 10.9.8.

## Affected products

- mermaid-js mermaid >= 11.0.0-alpha.1, < 11.16.1
- mermaid-js mermaid < 10.9.8

## Identifiers

- CVE-2026-50159
- GHSA-6x64-9x62-f2gx

## Timeline

- 2026-08-04: disclosed
- 2026-08-06: advisory
- 2026-08-06: patched

## References

- [https://api.github.com/users/h3ri0s](https://api.github.com/users/h3ri0s)
- [https://github.com/h3ri0s](https://github.com/h3ri0s)
- [https://api.github.com/users/h3ri0s/gists%7B/gist_id%7D](https://api.github.com/users/h3ri0s/gists%7B/gist_id%7D)
- [https://api.github.com/users/h3ri0s/repos](https://api.github.com/users/h3ri0s/repos)
- [https://avatars.githubusercontent.com/u/51421167?v=4](https://avatars.githubusercontent.com/u/51421167?v=4)
- [https://api.github.com/users/h3ri0s/events%7B/privacy%7D](https://api.github.com/users/h3ri0s/events%7B/privacy%7D)

## Related threats

- [Mermaid radar diagrams denial of service via unchecked ticks input](https://junglewise.ai/threats/cve-2026-71439-mermaid-radar-diagrams-denial-of-service-via-unchecked-ticks)
- [Mermaid prototype pollution in configuration APIs](https://junglewise.ai/threats/cve-2026-71438-mermaid-prototype-pollution-in-configuration-apis)
- [Mermaid prototype pollution in architecture-beta diagrams](https://junglewise.ai/threats/cve-2026-71437-mermaid-prototype-pollution-in-architecture-beta-diagrams)
- [Mermaid infinite loop in XY Charts axis processing](https://junglewise.ai/threats/cve-2026-71436-mermaid-infinite-loop-in-xy-charts-axis-processing)
- [Mermaid CSS injection via configuration options](https://junglewise.ai/threats/cve-2026-41159-mermaid-css-injection-via-configuration-options)