Code Injection in mermaid - CVE-2026-50159
Published: August 4, 2026
Vulnerability identifier: #VU140937
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-50159
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to manipulate the user interface of adjacent page elements.
The vulnerability exists due to improper control of generated stylesheet content in the CSS scoping middleware when processing attacker-supplied diagram source. A remote attacker can supply crafted CSS selectors using sibling combinators to manipulate the user interface of adjacent page elements.
This affects cases where the rendered SVG is inserted into the DOM alongside sibling elements rather than being the only child of its parent.
Affected software
mermaid
How to mitigate CVE-2026-50159
Install security update from vendor's website.
mermaid - addressed in versions 10.9.8, 11.16.1