CVE-2026-41159

Katalog CVE

CVSS 5.3 · Medium EPSS 0,55%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada mermaid project mermaid. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options. The injected CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping, applying styles to all page elements. Global at-rules (@font-face, @keyframes, @counter-style) are also injectable as stylis hoists them to top level. This allows page defacement and DOM attribute exfiltration via CSS :has() selectors. This vulnerability is fixed in 10.9.6 and 11.15.0.

Rincian

Terbit di NVD

29 Mei 2026

Terakhir diubah

21 Juli 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p advisory pihak ketiga
• https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa
• https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.15.0 release notes
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6 release notes