PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41150 mermaid-js CVE debrief

A denial-of-service vulnerability exists in Mermaid, a JavaScript diagramming library, when rendering Gantt charts with the excludes attribute configured to exclude all dates. The issue affects versions prior to 10.9.6 and 11.15.0. While mermaid.parse itself is not directly vulnerable, the ganttDb.getTasks() function—invoked during diagram rendering—triggers the flaw. An attacker could exploit this by supplying a malicious Gantt chart definition that causes excessive resource consumption or application hang. The vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition). Fixes are available in releases 10.9.6 and 11.15.0.

Vendor
mermaid-js
Product
mermaid
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-21
Advisory published
2026-05-29
Advisory updated
2026-07-21

Who should care

Organizations using Mermaid for server-side or client-side diagram rendering, particularly those accepting untrusted user input for Gantt charts. Developers integrating Mermaid into documentation platforms, wikis, or collaborative tools should prioritize patching.

Technical summary

The vulnerability stems from improper handling of edge cases in Gantt chart date exclusion logic. When the excludes attribute is set to exclude all possible dates, the rendering process enters a problematic state through ganttDb.getTasks(). This results in a denial-of-service condition. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, and user interaction required, with low availability impact. The fix addresses the loop condition to properly handle cases where all dates are excluded.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Mermaid to version 10.9.6 or 11.15.0 or later
  • If upgrading is not immediately possible, validate and sanitize Gantt chart input to prevent excludes attributes that exclude all dates
  • Review applications that render user-supplied Mermaid diagrams for potential DoS exposure
  • Monitor for unusual resource consumption when processing Gantt chart diagrams

Evidence notes

CVE published 2026-05-29. Advisory confirms DoS via Gantt chart excludes attribute. Patches released in 10.9.6 and 11.15.0.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-41150 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-41150

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-41150 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41150

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.