{"schema_version":1,"title":"mermaid (npm) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 16 vulnerabilities in mermaid (npm): 0 in the last 7 days and 5 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-50159, was published on 6 August 2026.","url":"https://junglewise.ai/threats/technologies/mermaid","json_url":"https://junglewise.ai/threats/technologies/mermaid.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/mermaid","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":0,"all_time":16,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":5,"last_365_days":9},"latest":[{"cve":"CVE-2026-50159","cvss":4,"epss":0.006,"slug":"cve-2026-50159-mermaid-css-injection-via-sibling-combinators","title":"Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid","severity":"medium","exploited":false,"published_at":"2026-08-06T22:17:17.18+00:00","url":"https://junglewise.ai/threats/cve-2026-50159-mermaid-css-injection-via-sibling-combinators"},{"cve":"CVE-2026-71439","cvss":4,"epss":0.0053,"slug":"cve-2026-71439-mermaid-radar-diagrams-denial-of-service-via-unchecked-ticks","title":"Mermaid radar diagrams denial of service via unchecked ticks input","severity":"medium","exploited":false,"published_at":"2026-08-06T20:01:07+00:00","url":"https://junglewise.ai/threats/cve-2026-71439-mermaid-radar-diagrams-denial-of-service-via-unchecked-ticks"},{"cve":"CVE-2026-71438","cvss":4,"epss":0.0035,"slug":"cve-2026-71438-mermaid-prototype-pollution-in-configuration-apis","title":"Mermaid prototype pollution in configuration APIs","severity":"medium","exploited":false,"published_at":"2026-08-06T19:59:10+00:00","url":"https://junglewise.ai/threats/cve-2026-71438-mermaid-prototype-pollution-in-configuration-apis"},{"cve":"CVE-2026-71437","cvss":4,"epss":0.005,"slug":"cve-2026-71437-mermaid-prototype-pollution-in-architecture-beta-diagrams","title":"Mermaid prototype pollution in architecture-beta diagrams","severity":"medium","exploited":false,"published_at":"2026-08-06T19:51:59+00:00","url":"https://junglewise.ai/threats/cve-2026-71437-mermaid-prototype-pollution-in-architecture-beta-diagrams"},{"cve":"CVE-2026-71436","cvss":4,"epss":0.0058,"slug":"cve-2026-71436-mermaid-infinite-loop-in-xy-charts-axis-processing","title":"Mermaid infinite loop in XY Charts axis processing","severity":"medium","exploited":false,"published_at":"2026-08-06T19:49:48+00:00","url":"https://junglewise.ai/threats/cve-2026-71436-mermaid-infinite-loop-in-xy-charts-axis-processing"},{"cve":"CVE-2026-41159","cvss":4,"epss":0.0055,"slug":"cve-2026-41159-mermaid-css-injection-via-configuration-options","title":"Mermaid CSS injection via configuration options","severity":"medium","exploited":false,"published_at":"2026-05-29T15:16:22.813+00:00","url":"https://junglewise.ai/threats/cve-2026-41159-mermaid-css-injection-via-configuration-options"},{"cve":"CVE-2026-41150","cvss":5.3,"epss":0.0053,"slug":"cve-2026-41150-mermaid-infinite-loop-denial-of-service-in-gantt-charts","title":"Mermaid infinite loop denial of service in Gantt charts","severity":"medium","exploited":false,"published_at":"2026-05-29T15:16:22.673+00:00","url":"https://junglewise.ai/threats/cve-2026-41150-mermaid-infinite-loop-denial-of-service-in-gantt-charts"},{"cve":"CVE-2026-41149","cvss":4,"epss":0.0052,"slug":"cve-2026-41149-mermaid-html-injection-in-state-diagram-classdef","title":"Mermaid HTML injection in state diagram classDef","severity":"medium","exploited":false,"published_at":"2026-05-22T23:16:53.75+00:00","url":"https://junglewise.ai/threats/cve-2026-41149-mermaid-html-injection-in-state-diagram-classdef"},{"cve":"CVE-2026-41148","cvss":4,"epss":0.006,"slug":"cve-2026-41148-mermaid-css-injection-in-class-definitions","title":"Mermaid CSS injection in class definitions","severity":"medium","exploited":false,"published_at":"2026-05-22T23:16:53.593+00:00","url":"https://junglewise.ai/threats/cve-2026-41148-mermaid-css-injection-in-class-definitions"},{"cve":"CVE-2025-54881","cvss":4,"epss":0.0076,"slug":"cve-2025-54881-mermaid-xss-in-sequence-diagram-labels","title":"Mermaid XSS in sequence diagram labels","severity":"medium","exploited":false,"published_at":"2025-08-19T20:16:58+00:00","url":"https://junglewise.ai/threats/cve-2025-54881-mermaid-xss-in-sequence-diagram-labels"},{"cve":"CVE-2025-54880","cvss":4,"epss":0.0037,"slug":"cve-2025-54880-mermaid-improper-sanitization-of-architecture-diagram-icontext","title":"Mermaid improper sanitization of architecture diagram iconText leading to XSS","severity":"medium","exploited":false,"published_at":"2025-08-19T20:16:45+00:00","url":"https://junglewise.ai/threats/cve-2025-54880-mermaid-improper-sanitization-of-architecture-diagram-icontext"},{"cvss":3.1,"slug":"mermaid-prototype-pollution-in-bundled-dompurify-655b89f2","title":"Mermaid prototype pollution in bundled DOMPurify","severity":"low","exploited":false,"published_at":"2024-10-22T18:17:02+00:00","url":"https://junglewise.ai/threats/mermaid-prototype-pollution-in-bundled-dompurify-655b89f2"},{"cve":"CVE-2022-31108","cvss":3.1,"epss":0.0091,"slug":"cve-2022-31108-mermaid-js-css-injection-via-theme-variables","title":"Mermaid.js CSS injection via theme variables","severity":"low","exploited":false,"published_at":"2022-07-05T18:29:31+00:00","url":"https://junglewise.ai/threats/cve-2022-31108-mermaid-js-css-injection-via-theme-variables"},{"cve":"CVE-2021-43861","cvss":3.1,"epss":0.0091,"slug":"cve-2021-43861-mermaid-incorrect-sanitization-leading-to-xss","title":"Mermaid incorrect sanitization leading to XSS","severity":"low","exploited":false,"published_at":"2022-01-06T19:45:59+00:00","url":"https://junglewise.ai/threats/cve-2021-43861-mermaid-incorrect-sanitization-leading-to-xss"},{"cve":"CVE-2021-35513","cvss":3.1,"epss":0.0102,"slug":"cve-2021-35513-mermaid-cross-site-scripting-in-antiscript-feature","title":"Mermaid cross-site scripting in antiscript feature","severity":"low","exploited":false,"published_at":"2021-12-10T18:57:41+00:00","url":"https://junglewise.ai/threats/cve-2021-35513-mermaid-cross-site-scripting-in-antiscript-feature"},{"slug":"mermaid-cross-site-scripting-in-diagram-rendering-f7b8e44e","title":"mermaid cross-site scripting in diagram rendering","severity":"info","exploited":false,"published_at":"2020-09-02T15:41:41+00:00","url":"https://junglewise.ai/threats/mermaid-cross-site-scripting-in-diagram-rendering-f7b8e44e"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"flowise (npm)","slug":"flowise","vulnerabilities":156,"url":"https://junglewise.ai/threats/technologies/flowise"},{"name":"vm2 (npm)","slug":"vm2","vulnerabilities":82,"url":"https://junglewise.ai/threats/technologies/vm2"},{"name":"@budibase/server (npm)","slug":"budibase-server","vulnerabilities":61,"url":"https://junglewise.ai/threats/technologies/budibase-server"},{"name":"directus (npm)","slug":"directus","vulnerabilities":60,"url":"https://junglewise.ai/threats/technologies/directus"},{"name":"nocodb (npm)","slug":"nocodb","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/nocodb"},{"name":"hono (npm)","slug":"hono","vulnerabilities":54,"url":"https://junglewise.ai/threats/technologies/hono"},{"name":"parse-server (npm)","slug":"parse-server","vulnerabilities":42,"url":"https://junglewise.ai/threats/technologies/parse-server"},{"name":"dompurify (npm)","slug":"dompurify","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/dompurify"},{"name":"ghost (npm)","slug":"ghost","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/ghost"},{"name":"flowise-components (npm)","slug":"flowise-components","vulnerabilities":35,"url":"https://junglewise.ai/threats/technologies/flowise-components"},{"name":"astro (npm)","slug":"astro","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/astro"},{"name":"@anthropic-ai/claude-code (npm)","slug":"anthropic-ai-claude-code","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/anthropic-ai-claude-code"}],"technology":{"hub":true,"name":"mermaid (npm)","slug":"mermaid","vendor":{"name":"npm","slug":"npm","url":"https://junglewise.ai/threats/vendors/npm"},"aliases":[],"homepage":"https://mermaid.js.org/","repo_url":"https://github.com/mermaid-js/mermaid","description":"A JavaScript-based diagramming and charting tool that renders Markdown-inspired text definitions.","url":"https://junglewise.ai/threats/technologies/mermaid"},"most_severe":[{"cve":"CVE-2026-41150","cvss":5.3,"epss":0.0053,"slug":"cve-2026-41150-mermaid-infinite-loop-denial-of-service-in-gantt-charts","title":"Mermaid infinite loop denial of service in Gantt charts","severity":"medium","exploited":false,"published_at":"2026-05-29T15:16:22.673+00:00","url":"https://junglewise.ai/threats/cve-2026-41150-mermaid-infinite-loop-denial-of-service-in-gantt-charts"},{"cve":"CVE-2025-54881","cvss":4,"epss":0.0076,"slug":"cve-2025-54881-mermaid-xss-in-sequence-diagram-labels","title":"Mermaid XSS in sequence diagram labels","severity":"medium","exploited":false,"published_at":"2025-08-19T20:16:58+00:00","url":"https://junglewise.ai/threats/cve-2025-54881-mermaid-xss-in-sequence-diagram-labels"},{"cve":"CVE-2026-50159","cvss":4,"epss":0.006,"slug":"cve-2026-50159-mermaid-css-injection-via-sibling-combinators","title":"Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid","severity":"medium","exploited":false,"published_at":"2026-08-06T22:17:17.18+00:00","url":"https://junglewise.ai/threats/cve-2026-50159-mermaid-css-injection-via-sibling-combinators"},{"cve":"CVE-2026-41148","cvss":4,"epss":0.006,"slug":"cve-2026-41148-mermaid-css-injection-in-class-definitions","title":"Mermaid CSS injection in class definitions","severity":"medium","exploited":false,"published_at":"2026-05-22T23:16:53.593+00:00","url":"https://junglewise.ai/threats/cve-2026-41148-mermaid-css-injection-in-class-definitions"},{"cve":"CVE-2026-71436","cvss":4,"epss":0.0058,"slug":"cve-2026-71436-mermaid-infinite-loop-in-xy-charts-axis-processing","title":"Mermaid infinite loop in XY Charts axis processing","severity":"medium","exploited":false,"published_at":"2026-08-06T19:49:48+00:00","url":"https://junglewise.ai/threats/cve-2026-71436-mermaid-infinite-loop-in-xy-charts-axis-processing"},{"cve":"CVE-2026-41159","cvss":4,"epss":0.0055,"slug":"cve-2026-41159-mermaid-css-injection-via-configuration-options","title":"Mermaid CSS injection via configuration options","severity":"medium","exploited":false,"published_at":"2026-05-29T15:16:22.813+00:00","url":"https://junglewise.ai/threats/cve-2026-41159-mermaid-css-injection-via-configuration-options"},{"cve":"CVE-2026-71439","cvss":4,"epss":0.0053,"slug":"cve-2026-71439-mermaid-radar-diagrams-denial-of-service-via-unchecked-ticks","title":"Mermaid radar diagrams denial of service via unchecked ticks input","severity":"medium","exploited":false,"published_at":"2026-08-06T20:01:07+00:00","url":"https://junglewise.ai/threats/cve-2026-71439-mermaid-radar-diagrams-denial-of-service-via-unchecked-ticks"},{"cve":"CVE-2026-41149","cvss":4,"epss":0.0052,"slug":"cve-2026-41149-mermaid-html-injection-in-state-diagram-classdef","title":"Mermaid HTML injection in state diagram classDef","severity":"medium","exploited":false,"published_at":"2026-05-22T23:16:53.75+00:00","url":"https://junglewise.ai/threats/cve-2026-41149-mermaid-html-injection-in-state-diagram-classdef"},{"cve":"CVE-2026-71437","cvss":4,"epss":0.005,"slug":"cve-2026-71437-mermaid-prototype-pollution-in-architecture-beta-diagrams","title":"Mermaid prototype pollution in architecture-beta diagrams","severity":"medium","exploited":false,"published_at":"2026-08-06T19:51:59+00:00","url":"https://junglewise.ai/threats/cve-2026-71437-mermaid-prototype-pollution-in-architecture-beta-diagrams"},{"cve":"CVE-2025-54880","cvss":4,"epss":0.0037,"slug":"cve-2025-54880-mermaid-improper-sanitization-of-architecture-diagram-icontext","title":"Mermaid improper sanitization of architecture diagram iconText leading to XSS","severity":"medium","exploited":false,"published_at":"2025-08-19T20:16:45+00:00","url":"https://junglewise.ai/threats/cve-2025-54880-mermaid-improper-sanitization-of-architecture-diagram-icontext"}],"generated_at":"2026-09-26T10:14:00.201383+00:00"}