Security: mermaid-js/mermaid
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Mermaid Architecture diagrams are vulnerable to prototype pollutionGHSA-3rrr-jr9j-h3q3 published
Aug 4, 2026 by aloisklinkModerate -
Mermaid radar diagrams are vulnerable to DoSGHSA-rhh3-jpg6-66xh published
Aug 4, 2026 by aloisklinkModerate -
Mermaid XY Charts are vulnerable to an infinite loop DoSGHSA-2v8p-3f2j-5mp7 published
Aug 4, 2026 by aloisklinkModerate -
Mermaid configuration APIs allow prototype pollutionGHSA-c4c3-pg64-4m4v published
Aug 4, 2026 by aloisklinkLow -
Mermaid allows CSS injection applying to sibling elements of the diagramGHSA-6x64-9x62-f2gx published
Aug 4, 2026 by aloisklinkModerate -
Improper sanitization of configuration leads to CSS injectionGHSA-87f9-hvmw-gh4p published
May 11, 2026 by aloisklinkModerate -
Improper sanitization of `classDef` in state diagrams leads to HTML injectionGHSA-ghcm-xqfw-q4vr published
May 11, 2026 by aloisklinkModerate -
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoSGHSA-6m6c-36f7-fhxh published
May 11, 2026 by aloisklinkModerate -
Improper sanitization of `classDefs` in diagrams leads to CSS injectionGHSA-xcj9-5m2h-648r published
May 11, 2026 by aloisklinkModerate -
Improper sanitization of architecture diagram iconText leads to XSSGHSA-8gwm-58g9-j8pw published
Aug 19, 2025 by sidharthv96Critical