beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS)

Description

beautiful-mermaid versions prior to 0.1.3 contain an SVG attribute injection issue that can lead to cross-site scripting (XSS) when rendering attacker-controlled Mermaid diagrams.

Recommendation

Update the beautiful-mermaid package to the latest compatible version. Followings are version details:

Affected version(s): < 0.1.3
Patched version(s): 0.1.3

References

GHSA-cgmm-x5ww-q5cr
neo.projectdiscovery.io
www.vulncheck.com
CVE-2026-26226
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS) and gives you actionable findings to investigate.

Start a free scan

Related Issues

Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE) - CVE-2026-23733
LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution - CVE-2026-42045
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - CVE-2026-47761

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

How to Secure your NodeJs Express Javascript Application - part 1

See something that needs correcting? Let us knowUpdated February 13, 2026