SB2026080474 - Multiple vulnerabilities in mermaid

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080474

SB2026080474 - Multiple vulnerabilities in mermaid

Published: August 4, 2026

Security Bulletin ID SB2026080474
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 20% Medium 40% Low 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Prototype pollution (CVE-ID: N/A)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service or corrupt application logic.

The vulnerability exists due to improperly controlled modification of object prototype attributes ('prototype pollution') in the architecture-beta diagram renderer when rendering an untrusted diagram. A remote user can supply a crafted diagram with a group id of __proto__ to cause a denial of service or corrupt application logic.

The injected property value is limited to the string horizontal or vertical and does not directly enable remote code execution.


2) Unchecked Input for Loop Condition (CVE-ID: N/A)

CWE-ID: CWE-606 - Unchecked Input for Loop Condition

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to unchecked input for loop condition in radar diagram rendering when processing a crafted ticks value. A remote attacker can supply a specially crafted radar diagram to cause a denial of service.

User interaction is required to render the crafted diagram.


3) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a loop with an unreachable exit condition in the setXAxisRangeData() function when processing crafted XY chart input with invalid x-axis parameters. A remote attacker can supply specially crafted chart data to cause a denial of service.

User interaction is required to load or render the crafted chart content.


4) Prototype pollution (CVE-ID: N/A)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to modify object prototypes.

The vulnerability exists due to improperly controlled modification of object prototype attributes in the mermaid configuration setters when merging caller-supplied configuration objects into the internal config. A local privileged user can supply a crafted configuration object to modify object prototypes.

The issue is only reachable if an application forwards attacker-controlled data directly into these configuration entry points; user-controlled configuration in diagram code and YAML frontmatter is already protected.


5) Code Injection (CVE-ID: CVE-2026-50159)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to manipulate the user interface of adjacent page elements.

The vulnerability exists due to improper control of generated stylesheet content in the CSS scoping middleware when processing attacker-supplied diagram source. A remote attacker can supply crafted CSS selectors using sibling combinators to manipulate the user interface of adjacent page elements.

This affects cases where the rendered SVG is inserted into the DOM alongside sibling elements rather than being the only child of its parent.


Remediation

Install update from vendor's website.

References