{"action":"Upgrade mermaid to 10.9.6 or later.","affected":[{"fixed":"11.15.0","introduced":"11.0.0-alpha.1"},{"fixed":"10.9.6","introduced":"0"}],"component":"mermaid","cve_ids":["CVE-2026-41159"],"ecosystem":"npm","epss":0.00486,"exploited":false,"fixed_versions":["11.15.0","10.9.6"],"ghsa_id":"GHSA-87f9-hvmw-gh4p","id":"tcs_01M5KFC4KGQP1GCWXSE5TAHAMA","modified_at":"2026-09-10T03:51:04.895749263Z","published_at":"2026-05-11T19:37:00Z","references":["https://osv.dev/vulnerability/GHSA-87f9-hvmw-gh4p","https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p","https://nvd.nist.gov/vuln/detail/CVE-2026-41159","https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa","https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76","https://github.com/mermaid-js/mermaid","https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0","https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.15.0","https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-87f9-hvmw-gh4p","url":"https://osv.dev/vulnerability/GHSA-87f9-hvmw-gh4p"},{"source":"nvd","source_id":"CVE-2026-41159","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41159"}],"summary":"Mermaid: Improper sanitization of configuration leads to CSS injection"}