Hi,
The following vulnerabilities were published for node-mermaid.
node-mermaid recently got reintroduced in Debian unstable, and I think
the current list is the remianing open ones, can you double-check
please?
CVE-2026-41148[0]:
| Mermaid is a JavaScript tool that uses Markdown-inspired text to
| create and modify diagrams and charts. Versions 10.9.5 and prior, in
| addition to 11.0.0-alpha.1 through 11.12.0 are vulnerable to CSS
| injection through improper sanitization. The state diagram (and any
| other diagram type that routes user-controlled style strings through
| the createCssStyles parser) captures classDef values using an
| unrestricted regex that matches everything up to a newline. That
| value then flows unsanitized through addStyleClass() into
| createCssStyles() and is assigned to style.innerHTML, so a closing
| brace (}) in the value terminates the generated CSS selector and
| turns everything after it into a new CSS rule on the page. This
| enables page defacement, user tracking via url() callbacks, and DOM
| attribute exfiltration. This issue has been fixed in versions 10.9.6
| and 11.15.0. If developers are unable to immediately upgrade, they
| can work around this issue by setting "securityLevel": "sandbox",
| which prevents the issue by rendering the mermaid diagram in a
| sandboxed <iframe>.
CVE-2026-41149[1]:
| Mermaid is a JavaScript tool that uses Markdown-inspired text to
| create and modify diagrams and charts. Versions 10.9.5 and earlier,
| as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML
| injection under the default configuration. Specifically, the
| classDef directive in Mermaid state diagrams permits DOM injection
| that escapes the SVG context. However, <script> tags are stripped,
| which prevents cross-site scripting (XSS). This issue has been fixed
| in versions 10.9.6 and 11.15.0. If developers are unable to
| immediately upgrade, they can work around this issue by setting
| "securityLevel": "sandbox", which prevents the issue by rendering
| the mermaid diagram in a sandboxed <iframe>.
CVE-2026-41150[2]:
| Mermaid is a JavaScript tool that uses Markdown-inspired text to
| create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0,
| there is a denial-of-service attack when rendering gantt charts, if
| they use the excludes attribute to exclude all dates. mermaid.parse
| is unaffected, unless you then call the ganttDb.getTasks() (which is
| called when rendering a diagram). This vulnerability is fixed in
| 10.9.6 and 11.15.0.
CVE-2026-41159[3]:
| Mermaid is a JavaScript tool that uses Markdown-inspired text to
| create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0,
| Mermaid's default configuration allows injecting CSS that applies
| outside of the Mermaid diagram via the fontFamily, themeCSS, and
| altFontFamily configuration options. The injected CSS exploits
| stylis's & (scope reference) handling. :not(&) escapes the #mermaid-
| xxx automatic scoping, applying styles to all page elements. Global
| at-rules (@font-face, @keyframes, @counter-style) are also
| injectable as stylis hoists them to top level. This allows page
| defacement and DOM attribute exfiltration via CSS :has() selectors.
| This vulnerability is fixed in 10.9.6 and 11.15.0.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-41148
https://www.cve.org/CVERecord?id=CVE-2026-41148
[1] https://security-tracker.debian.org/tracker/CVE-2026-41149
https://www.cve.org/CVERecord?id=CVE-2026-41149
[2] https://security-tracker.debian.org/tracker/CVE-2026-41150
https://www.cve.org/CVERecord?id=CVE-2026-41150
[3] https://security-tracker.debian.org/tracker/CVE-2026-41159
https://www.cve.org/CVERecord?id=CVE-2026-41159
Regards,
Salvatore