CVE-2026-26226 lukilabs CVE debrief

Who should care

Users of beautiful-mermaid versions prior to 0.1.3 should be aware of this vulnerability and take steps to mitigate it. This includes operators, administrators, and security teams responsible for managing and securing systems that use beautiful-mermaid. They should review and implement the recommended actions to prevent potential XSS attacks.

Technical summary

beautiful-mermaid versions prior to 0.1.3 contain an SVG attribute injection issue that can lead to cross-site scripting (XSS) when rendering attacker-controlled Mermaid diagrams. User-controlled values from Mermaid style and classDef directives are interpolated into SVG attribute values without proper escaping, allowing crafted input to break out of an attribute context and inject arbitrary SVG elements/attributes into the rendered output. When the generated SVG is embedded in a web page, this can result in script execution in the context of the embedding origin. This vulnerability has a CVSS score of 5.3 and a severity of MEDIUM.

Defensive priority

Medium priority due to CVSS score of 5.3

Recommended defensive actions

• Update beautiful-mermaid to version 0.1.3 or later
• Validate and sanitize user-controlled input to Mermaid style and classDef directives
• Implement additional security measures to prevent XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and testing may be necessary to fully understand the impact and mitigation strategies. Affected product deployments should be identified and verified for potential exposure. The CVE record was published on 2026-02-13T17:16:14.073Z and has not been modified since then. The NVD entry is currently Deferred. No additional information is available from the CVE record or NVD entry.

Official resources