CVE-2026-50159 mermaid-js CVE debrief

Who should care

Mermaid users and maintainers should assess exposure and prioritize remediation based on the potential impact on page appearance or behavior. This includes reviewing and updating Mermaid to version 10.9.8 or 11.16.1, verifying affected versions and scope, and monitoring for potential CSS injection attacks.

Why it matters

CVE-2026-50159 Mermaid CSS Injection Vulnerability requires attention from Mermaid users and maintainers to assess exposure and prioritize remediation.

• Potential alteration of page appearance or behavior
• Possible injection of arbitrary CSS
• Need for verification of affected versions and scope
• Priority for updating to fixed versions 10.9.8 or 11.16.1

Technical summary

Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1. The vulnerability requires attention from Mermaid users and maintainers to assess exposure and prioritize remediation based on the potential impact on page appearance or behavior and to verify affected versions and scope.

Defensive priority

Medium priority for Mermaid users and maintainers

Recommended defensive actions

• Review and update Mermaid to version 10.9.8 or 11.16.1
• Assess exposure and prioritize remediation for systems using Mermaid
• Monitor for potential CSS injection attacks
• Verify affected versions and scope
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected versions and potential impact require verification from official sources. The vulnerability allows for CSS injection, which can lead to alteration of page elements. Verification of affected versions and scope is necessary. Official sources such as the CVE Program record and NIST NVD detail page should be consulted for accurate information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.