VendorsMermaid Projectmermaidany version
Vulnerabilities

Mermaid Project Mermaid any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

6CVEs
CVE-2021-43861
Incorrect sanitisation function leads to `XSS`
Published 2021-12-30 · Modified
7.2EPSS 0.009
CVE-2021-35513
Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
Published 2021-06-27 · Modified
6.1EPSS 0.010
CVE-2022-31108
Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js
Published 2022-06-28 · Modified
6.1EPSS 0.009
CVE-2025-54880
Mermaid does not properly sanitize architecture diagram iconText leading to XSS
Published 2025-08-19 · Analyzed
6.1EPSS 0.004
CVE-2026-41159
Mermaid: Improper sanitization of configuration leads to CSS injection
Published 2026-05-29 · Modified
5.3EPSS 0.005
CVE-2026-41150
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
Published 2026-05-29 · Analyzed
5.3EPSS 0.005