CSS Injection Vulnerability in Mermaid JavaScript Tool from Mermaid

CVE-2026-41159

What is CVE-2026-41159?

Mermaid is a JavaScript tool that utilizes Markdown-inspired syntax for diagram creation. Prior to versions 10.9.6 and 11.15.0, Mermaid's default settings allowed for CSS injection through its configuration options. This security issue arises from how stylis handles scope references, permitting the application of injected CSS styles beyond the designated Mermaid diagram area. Consequently, vulnerabilities emerged enabling global style injections, such as @font-face and @keyframes, allowing attackers to alter page aesthetics and extract DOM attributes via CSS selectors. The issue has been rectified in the specified versions, enhancing the security posture of the Mermaid tool.

References