CVE-2026-41148: Mermaid JavaScript XSS Vulnerability

CVE-2026-41148 Overview

CVE-2026-41148 is a CSS injection vulnerability in Mermaid, a JavaScript library that renders diagrams and charts from Markdown-inspired text. The flaw affects Mermaid versions 10.9.5 and prior, as well as 11.0.0-alpha.1 through 11.12.0. State diagrams and other diagram types route user-controlled classDef style strings through the createCssStyles parser without proper sanitization. Attackers can inject arbitrary CSS rules by including a closing brace in the value, enabling page defacement, user tracking via url() callbacks, and DOM attribute exfiltration. The issue is fixed in versions 10.9.6 and 11.15.0. This vulnerability is classified under [CWE-94] Improper Control of Generation of Code.

Critical Impact
Attackers can inject arbitrary CSS into pages rendering untrusted Mermaid diagrams, leading to defacement, covert exfiltration of DOM attributes via attribute selectors, and tracking of users through CSS url() callbacks.

Affected Products

Mermaid versions 10.9.5 and prior
Mermaid versions 11.0.0-alpha.1 through 11.12.0
Applications embedding the vulnerable Mermaid library to render user-supplied diagram source

Discovery Timeline

2026-05-22 - CVE-2026-41148 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-41148

Vulnerability Analysis

The vulnerability resides in Mermaid's CSS generation pipeline for diagram styling. When a diagram defines a classDef, Mermaid captures the style string using an unrestricted regular expression that matches everything up to a newline. The captured value flows unsanitized through addStyleClass() into createCssStyles() and is ultimately assigned to style.innerHTML in the rendered DOM.

Because the assignment occurs without escaping or validating CSS metacharacters, a closing brace (}) embedded in the value prematurely terminates the generated CSS selector block. Everything following the brace becomes a new CSS rule scoped to the host page rather than the diagram. Attackers can use this primitive to apply arbitrary CSS, including attribute selectors that read sensitive DOM attributes and trigger network requests via url() to attacker-controlled servers.

Root Cause

The root cause is improper input sanitization on values supplied to the CSS generation path. The classDef parser uses a permissive regular expression that does not exclude CSS structural characters such as { and }. Combined with the use of style.innerHTML for injecting generated CSS, this allows user-controlled input to escape its intended selector context.

Attack Vector

An attacker who can provide diagram source to a Mermaid-rendering application supplies a classDef with a crafted style payload containing a } followed by attacker-defined CSS rules. The exploit requires user interaction in the sense that a victim must view the rendered page, but it does not require authentication. Common attack surfaces include wiki platforms, documentation sites, chat applications, and code hosting services that render Mermaid diagrams from user submissions.

typescript

// Patch excerpt: packages/mermaid/src/mermaidAPI.ts
 import type { D3Element, ParseOptions, ParseResult, RenderResult } from './types.js';
 import { decodeEntities } from './utils.js';
 import { toBase64 } from './utils/base64.js';
+import { sanitizeCss } from './utils/sanitizeDirective.js';

 const MAX_TEXTLENGTH = 50_000;
 const MAX_TEXTLENGTH_EXCEEDED_MSG =
// Source: https://github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f

The patch introduces a sanitizeCss helper imported from ./utils/sanitizeDirective.js and applies it to classDef values before they reach the CSS generation pipeline, neutralizing structural metacharacters.

Detection Methods for CVE-2026-41148

Indicators of Compromise

Mermaid diagram source containing classDef declarations with embedded } characters followed by additional CSS syntax
Outbound network requests to unexpected domains originating from CSS url() references on pages that render user-supplied Mermaid content
DOM <style> elements within Mermaid containers exposing rules that target selectors outside the diagram scope, such as input[value^=...]

Detection Strategies

Inventory all applications that embed Mermaid and identify versions in use against the vulnerable ranges (<= 10.9.5 and 11.0.0-alpha.1 through 11.12.0)
Scan stored user-generated content for diagram payloads containing suspicious sequences such as classDef values with } followed by { or url(
Review web server and proxy logs for unusual outbound HTTP/HTTPS requests triggered during page rendering, particularly to single-character or attribute-conditional paths typical of CSS exfiltration

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture violations from injected CSS attempting to load resources from unauthorized origins
Log and alert on changes to dependencies that pin Mermaid to vulnerable versions during CI/CD builds
Monitor application telemetry for client-side rendering errors involving the createCssStyles or addStyleClass code paths

How to Mitigate CVE-2026-41148

Immediate Actions Required

Upgrade Mermaid to version 10.9.6 or 11.15.0 or later across all applications and dependencies
Audit lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) to confirm transitive Mermaid installations are upgraded
For applications that cannot upgrade immediately, set Mermaid's securityLevel configuration to sandbox to render diagrams inside a sandboxed <iframe>
Review and sanitize stored user-generated Mermaid source for malicious classDef payloads before re-rendering

Patch Information

The Mermaid maintainers released fixes in Mermaid 10.9.6 and Mermaid 11.15.0. The fix adds a sanitizeCss utility that filters classDef style values before they reach the CSS generation pipeline. See the GitHub Security Advisory GHSA-xcj9-5m2h-648r for full advisory details and the remediation commit.

Workarounds

Configure Mermaid with "securityLevel": "sandbox" to isolate diagram rendering inside an <iframe> per the Mermaid Configuration Documentation
Enforce a strict Content Security Policy that blocks url() references to untrusted origins and disallows inline styles where feasible
Restrict Mermaid input to trusted authors only until upgrades are deployed across the environment

bash

# Mermaid initialization with sandbox securityLevel workaround
mermaid.initialize({
  startOnLoad: true,
  securityLevel: 'sandbox'
});