CVE-2026-41150
5.3 MEDIUMMermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts
Published: 2026-05-29 · Last updated: 2026-06-01
Severity and scoring
- CVSS
- 5.3 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CWE
- CWE-835
Affected products
| Vendor | Product |
|---|---|
| mermaid_project | mermaid |
Description
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates. mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram). This vulnerability is fixed in 10.9.6 and 11.15.0.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-41150
- [Patch]https://github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6
- [Patch]https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e
- [Other]https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0
- [Other]https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6
- [Other]https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh
- [Other]https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh
Related CVEs
Same vendor
- CVE-2026-41159 — Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts (5.3 MEDIUM)
Same CWE
- CVE-2026-48733 — ImageMagick is free and open-source software used for editing and manipulating digital images (4.7 MEDIUM)
- CVE-2026-46521 — ImageMagick is free and open-source software used for editing and manipulating digital images (5.5 MEDIUM)
- CVE-2026-46522 — ImageMagick is free and open-source software used for editing and manipulating digital images (7.5 HIGH)
- CVE-2026-49495 — Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks cycle detection ... (5.5 MEDIUM)
- CVE-2025-71330 — image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event l... (7.5 HIGH)