CVE-2026-41159 Overview
CVE-2026-41159 is a CSS injection vulnerability in Mermaid, a JavaScript library that converts Markdown-inspired text into diagrams and charts. The flaw affects Mermaid versions prior to 10.9.6 and 11.15.0. Attackers can inject CSS that applies outside of the Mermaid diagram scope through the fontFamily, themeCSS, and altFontFamily configuration options. The injection abuses stylis's & (scope reference) handling, where :not(&) escapes the #mermaid-xxx automatic scoping. Global at-rules such as @font-face, @keyframes, and @counter-style are also injectable because stylis hoists them to top level. Exploitation enables page defacement and DOM attribute exfiltration via CSS :has() selectors.
Critical Impact
Attackers can inject page-wide CSS through Mermaid configuration, enabling defacement and exfiltration of DOM attribute values through CSS selector-based side channels.
Affected Products
- Mermaid versions prior to 10.9.6
- Mermaid versions prior to 11.15.0 (11.x branch)
- Applications using mermaid_project:mermaid as a Node.js dependency
Discovery Timeline
- 2026-05-29 - CVE-2026-41159 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-41159
Vulnerability Analysis
Mermaid applies user-controlled values from the fontFamily, themeCSS, and altFontFamily configuration options into stylesheets that are normally scoped to a generated #mermaid-xxx selector. The library relies on the stylis CSS preprocessor to enforce that scoping. The vulnerability arises because stylis's handling of the & scope reference operator permits constructs that break out of the parent selector. The weakness is categorized as Improper Control of Generation of Code [CWE-94], applied here to CSS content rather than executable script.
Root Cause
The scope-prefixing logic in stylis treats :not(&) as a valid negation of the parent reference. When Mermaid generates rules of the form #mermaid-xxx { user-input }, an attacker-supplied :not(&) { ... } body produces selectors that match every element on the page except the diagram container. Additionally, stylis hoists global at-rules such as @font-face, @keyframes, and @counter-style to the top of the stylesheet, removing them from the diagram scope entirely. Both behaviors permit configuration values to influence styling outside the intended boundary.
Attack Vector
Exploitation requires that an application render Mermaid diagrams using attacker-influenced configuration values, such as diagram source from untrusted users or content management systems. The attacker supplies CSS through themeCSS, fontFamily, or altFontFamily, using :not(&) to escape the scope. Once injected, CSS :has() selectors combined with attribute selectors can probe DOM attribute values character by character, exfiltrating data through background-image network requests. The same primitive supports visual defacement of the host page. The injected content is CSS only, so no script execution is required.
No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-87f9-hvmw-gh4p for advisory details.
Detection Methods for CVE-2026-41159
Indicators of Compromise
- Outbound HTTP requests to attacker-controlled domains originating from CSS background-image: url(...) references inside rendered Mermaid pages.
- Mermaid configuration payloads containing :not(&), @font-face, @keyframes, or @counter-style directives stored in user-submitted diagram content.
- Unexpected page-wide style changes (fonts, colors, hidden elements) appearing only on pages that render Mermaid diagrams.
Detection Strategies
- Inspect stored Mermaid diagram sources and configuration values for the literal patterns :not(&), themeCSS, fontFamily, and altFontFamily containing CSS braces or at-rules.
- Add web application firewall rules that flag Mermaid initialization payloads carrying global at-rules or selector negation against the scope reference.
- Review software composition analysis (SCA) reports for mermaid package versions below 10.9.6 or 11.15.0.
Monitoring Recommendations
- Monitor Content Security Policy (CSP) violation reports for unexpected style-src or img-src activity on pages that render Mermaid.
- Log and review changes to Mermaid configuration objects passed to mermaid.initialize() in client-side bundles.
- Track outbound network connections from browsers loading diagram-bearing pages, correlating with diagram authors.
How to Mitigate CVE-2026-41159
Immediate Actions Required
- Upgrade Mermaid to version 11.15.0 for the 11.x branch or 10.9.6 for the 10.x branch.
- Audit applications that accept user-submitted Mermaid source or configuration and restrict the fontFamily, themeCSS, and altFontFamily fields to a known allowlist.
- Disable the securityLevel: 'loose' configuration where feasible and avoid passing untrusted strings into Mermaid initialization.
Patch Information
The issue is fixed in Mermaid 10.9.6 and 11.15.0. Patch details are available in the GitHub Release v11.15.0 and the GitHub Release v10.9.6 notes. The corresponding code changes are referenced in the vendor commit update.
Workarounds
- Strip or sanitize the themeCSS, fontFamily, and altFontFamily configuration keys before passing user-controlled values to Mermaid.
- Apply a strict Content Security Policy that blocks img-src to unapproved hosts to limit CSS-based exfiltration via url() requests.
- Render Mermaid diagrams inside a sandboxed iframe with a restricted origin so injected page-wide CSS cannot affect the parent document.
# Upgrade Mermaid via npm to a patched release
npm install mermaid@11.15.0
# or for the 10.x branch
npm install mermaid@10.9.6
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
