mermaid vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-41159Mediummermaid: Mermaid: Improper sanitization of configuration leads to CSS injection CVE-2026-41150Mediummermaid: Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS CVE-2026-41149Mediummermaid: Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection CVE-2026-41148Mediummermaid: Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection CVE-2025-54881Mediummermaid: Mermaid improperly sanitizes sequence diagram labels leading to XSS CVE-2025-54880Mediummermaid: Mermaid does not properly sanitize architecture diagram iconText leading to XSS GHSA-M4GQ-X24J-JPMFHighmermaid: Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify CVE-2022-31108Mediummermaid: Possible inject arbitrary `CSS` into the generated graph affecting the container HTML CVE-2021-43861Highmermaid: Incorrect sanitisation function leads to `XSS` in mermaid CVE-2021-35513Mediummermaid: Cross-site Scripting in Mermaid GHSA-W32G-5HQP-GG6QHighmermaid: Cross-Site Scripting in mermaid

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo