Known vulnerabilities in mermaid

Vendor: mermaid-js
Software: mermaid
Software CPE: cpe:2.3:a:mermaid-js:mermaid:*:*:*:*:*:*:*:*
Total vulnerabilities: 14
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 7.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting mermaid mermaid is affected by 14 known vulnerabilities: 1 high, 8 medium, 5 low Critical High Medium Low

Vulnerabilities (14)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU140937 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-50159
CWE-94 Medium
No
No
10.9.8, 11.16.1 04.08.2026 SB2026080474
#VU140936 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2026-71438
CWE-1321 Medium
No
No
10.9.8, 11.16.1 04.08.2026 SB2026080474
#VU140935 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2026-71436
CWE-835 Low
No
No
10.9.8, 11.16.1 04.08.2026 SB2026080474
#VU140933 - Unchecked Input for Loop Condition
CVE-2026-71439
CWE-606 Low
No
No
11.16.1 04.08.2026 SB2026080474
#VU140932 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2026-71437
CWE-1321 High
No
No
11.16.1 04.08.2026 SB2026080474
#VU131137 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-41148
CWE-94 Medium
No
No
10.9.6, 11.15.0 12.05.2026 SB2026051244
#VU131136 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2026-41150
CWE-835 Low
No
No
10.9.6, 11.15.0 12.05.2026 SB2026051244
#VU131135 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-41149
CWE-94 Medium
No
No
10.9.6, 11.15.0 12.05.2026 SB2026051244
#VU131134 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-41159
CWE-94 Medium
No
No
10.9.6, 11.15.0 12.05.2026 SB2026051244
#VU116013 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-54880
CWE-79 Low
No
No
11.10.0 23.09.2025 SB2025092311
SB2025092318
SB2025092319
and 12 more
#VU116012 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-54881
CWE-79 Low
No
No
10.9.4, 11.10.0 23.09.2025 SB2025092311
SB2025092318
SB2025092319
and 11 more
#VU97758 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2024-45801
CWE-1321 Medium
No
No
10.9.3, 11.0.0 27.09.2024 SB2024092751
SB2024100823
SB2024100827
and 32 more
#VU127459 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-31108
CWE-79 Medium
No
No
9.1.2 28.06.2022 SB2022062843
#VU127461 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-43861
CWE-79 Medium
No
No
8.13.7 29.12.2021 SB2021122919