CVE-2026-41159 Mermaid: Improper sanitization of configuration leads to CSS injection
Attackers can inject CSS to deface pages and exfiltrate DOM attributes via Mermaid configuration options, affecting applications using the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-41159?
CVE-2026-41159 is a medium-severity cross-site scripting vulnerability in mermaid-js mermaid, published on 29 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options. The injected CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping, applying styles to all page elements. Global at-rules (@font-face, @keyframes, @counter-style) are also injectable as stylis hoists them to top level. This allows page defacement and DOM attribute exfiltration via CSS :has() selectors. This vulnerability is fixed in 10.9.6 and 11.15.0.
Weakness: CWE-94
Which versions are affected by CVE-2026-41159?
4 open source packages ship an affected version, including mermaid. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mermaid npm | All versions | 10.9.6 |
mermaid npm | All versions | 10.9.6 |
mermaid npm | From 11.0.0-alpha.1 | 11.15.0 |
mermaid npm | From 11.0.0-alpha.1 | 11.15.0 |
Products include Mermaid Project Mermaid.
How do I fix CVE-2026-41159?
Upgrade mermaid to a fixed version for your release line: 10.9.6 or 11.15.0.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-41159 being exploited?
There is no known exploitation of CVE-2026-41159 in the wild and no public exploit code.
Other vulnerabilities in mermaid-js mermaid
- CVE-2021-43861 Incorrect sanitisation function leads to `XSS`
- CVE-2021-35513 Cross-site Scripting in Mermaid
- CVE-2026-41150 Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
- CVE-2025-54880 Mermaid does not properly sanitize architecture diagram iconText leading to XSS
- CVE-2022-31108 Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js
Sources
Also known as DEBIAN-CVE-2026-41159, GHSA-87f9-hvmw-gh4p, MINI-686p-c639-hg28, MINI-hpvg-h3xp-x3jg, UBUNTU-CVE-2026-41159.