CVE-2026-41148

{
  "id": "CVE-2026-41148",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41148",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-27T13:25:29.202814Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "mermaid-js",
          "product": "mermaid",
          "versions": [
            {
              "status": "affected",
              "version": ">= 11.0.0-alpha.1, < 11.15.0"
            },
            {
              "status": "affected",
              "version": "< 10.9.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-22T23:16:53.593",
  "references": [
    {
      "url": "https://github.com/mermaid-js/mermaid/commit/8fead23c59166b7bab6a39eac81acebee2859102",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://mermaid.js.org/config/schema-docs/config.html#securitylevel",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and prior, in addition to 11.0.0-alpha.1 through 11.12.0 are vulnerable to CSS injection through improper sanitization. The state diagram (and any other diagram type that routes user-controlled style strings through the createCssStyles parser) captures classDef values using an unrestricted regex that matches everything up to a newline. That value then flows unsanitized through addStyleClass() into createCssStyles() and is assigned to style.innerHTML, so a closing brace (}) in the value terminates the generated CSS selector and turns everything after it into a new CSS rule on the page. This enables page defacement, user tracking via url() callbacks, and DOM attribute exfiltration. This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting \"securityLevel\": \"sandbox\", which prevents the issue by rendering the mermaid diagram in a sandboxed <iframe>."
    },
    {
      "lang": "es",
      "value": "Mermaid es una herramienta de JavaScript que utiliza texto inspirado en Markdown para crear y modificar diagramas y gráficos. Las versiones 10.9.5 y anteriores, además de la 11.0.0-alpha.1 hasta la 11.12.0, son vulnerables a la inyección de CSS debido a una sanitización inadecuada. El diagrama de estados (y cualquier otro tipo de diagrama que enruta cadenas de estilo controladas por el usuario a través del analizador createCssStyles) captura valores de classDef utilizando una expresión regular no restringida que coincide con todo hasta un salto de línea. Ese valor luego fluye sin sanitizar a través de addStyleClass() hacia createCssStyles() y se asigna a style.innerHTML, por lo que una llave de cierre (}) en el valor termina el selector CSS generado y convierte todo lo que le sigue en una nueva regla CSS en la página. Esto permite la desfiguración de páginas, el seguimiento de usuarios a través de devoluciones de llamada url() y la exfiltración de atributos DOM. Este problema ha sido solucionado en las versiones 10.9.6 y 11.15.0. Si los desarrolladores no pueden actualizar de inmediato, pueden solucionar este problema estableciendo 'securityLevel': 'sandbox', lo que evita el problema al renderizar el diagrama de mermaid en un <iframe> en sandbox."
    }
  ],
  "lastModified": "2026-07-23T11:10:00.120",
  "sourceIdentifier": "security-advisories@github.com"
}