VDB
CVE-2026-50159
CVE-2026-50159
PUBLISHED
CVSS 5.3 MEDIUM
Reported by GitHub_M · Published August 6, 2026
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1.
Risk Scores
CVSS 4.0
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| mermaid-js | mermaid | < 10.9.8, >= 11.0.0-alpha.1, < 11.16.1 |
| chainguard | langfuse-3 | 0, 0, 0 |
| chainguard | gitlab-rails-ce-fips-19.0 | 0 |
| wolfi | jupyter-base-notebook | 0, 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0, 0, 0 |
| chainguard | tensorflow-gpu-jupyter | 0 |
| wolfi | langfuse-3 | 0, 0, 0 |
| chainguard | langfuse-4 | 0, 0, 0 |
| chainguard | langfuse-fips-3 | 0, 0, 0 |
| chainguard | gitlab-rails-ce-fips-18.10 | 0 |
| chainguard | gitlab-rails-ce-fips-18.11 | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0, 0, 0 |
| npm | mermaid | 11.0.0-alpha.1, 0 |
| chainguard | commercial-gitlab-rails-ee-19.1 | 0 |
| chainguard | langfuse-fips-2 | 0, 0, 0 |
| mermaid-js | mermaid | >= 11.0.0-alpha.1, < 11.16.1, < 10.9.8, >= 11.0.0-alpha.1, < 11.16.1 |
| chainguard | langfuse-2 | 0, 0, 0 |
| chainguard | jupyter-base-notebook | 0 |
| chainguard | gitlab-rails-ce-fips-19.3 | 0, 0, 0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 0 |
…and 3 more
Timeline
- Aug 6, 2026 CVE Published
- Aug 7, 2026 EPSS Score
- Aug 7, 2026 Coalition ESS Score
- Aug 9, 2026 Security Advisory
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 28, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 3, 2026 EPSS Score
- Sep 5, 2026 EPSS Score
- Sep 6, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
References
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx x_refsource_CONFIRM
- https://github.com/mermaid-js/mermaid/pull/8022 x_refsource_MISC
- https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed x_refsource_MISC
- https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e x_refsource_MISC
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1 x_refsource_MISC
- https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-50159 advisory
- https://github.com/advisories/GHSA-6x64-9x62-f2gx advisory