5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41148

CVE-2026-41148: Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and prior, in addition to 11.0.0-alpha.1 through 11.12.0 are vulnerable to CSS injection through improper sanitization. The state diagram (and any other diagram type that routes user-controlled style strings through the createCssStyles parser) captures classDef values using an unrestricted regex that matches everything up to a newline. That value then flows unsanitized through addStyleClass() into createCssStyles() and is assigned to style.innerHTML, so a closing brace (}) in the value terminates the generated CSS selector and turns everything after it into a new CSS rule on the page. This enables page defacement, user tracking via url() callbacks, and DOM attribute exfiltration. This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed <iframe>.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41148

CVE-2026-41148:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mermaid	npm	>= 11.0.0-alpha.1, <= 11.14.0	11.15.0
mermaid	npm	<= 10.9.5	10.9.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper sanitization of CSS style definitions provided through classDef in Mermaid diagrams. The analysis of the patches reveals two key functions involved in this vulnerability.

The function createUserStyles is identified as the entry point for the malicious input. The test cases added in the patches explicitly use this function to demonstrate the CSS injection vector by passing a crafted style string. This function is responsible for orchestrating the creation of styles from user-provided classDef values.

The lower-level function cssImportantStyles is where the actual insecure string concatenation occurs. In the vulnerable versions, this function takes style classes and directly embeds them into a CSS rule string. The patch applies the sanitizeCss function to the user-controllable input within cssImportantStyles, thus mitigating the vulnerability by preventing the injection of unbalanced braces and additional CSS rules.

Therefore, during exploitation, a runtime profile would likely show createUserStyles initiating the style generation process, which in turn calls cssImportantStyles where the unsanitized user input is processed, leading to the CSS injection.

Vulnerable functions

createUserStyles

packages/mermaid/src/mermaidAPI.ts

This function processes `classDef` styles to generate CSS. The test case added in the patch shows that it can be exploited by a malicious style string in `classDef`. The vulnerable version of this function passes user-defined styles to other functions for CSS rule construction without proper sanitization, leading to CSS injection.

cssImportantStyles

packages/mermaid/src/mermaidAPI.ts

This function constructs a CSS style rule. In the vulnerable version, it directly concatenates the `cssClasses` parameter, which can be controlled by user input via `classDef`, into the CSS rule without sanitization. This allows an attacker to break out of the intended CSS rule and inject arbitrary CSS.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.