CVE-2026-50159
1 advisory.
npm/mermaid CVE-2026-50159: medium
Mermaid allows CSS injection applying to sibling elements of the diagram
Action: Upgrade mermaid to 10.9.8 or later.
npm i mermaid@11.16.1npm i mermaid@10.9.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 11.0.0-alpha.1 | 11.16.1 | - |
| 0 | 10.9.8 | - |
Fixed versions
| 11.16.1 | 10.9.8 |
Sources
- osv: GHSA-6x64-9x62-f2gx
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx
- https://github.com/mermaid-js/mermaid/pull/8022
- https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed
- https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e
- https://github.com/mermaid-js/mermaid
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1
- https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8
CVE-2026-50159 · published · modified · JSON