Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection

Description

The state diagram and any other diagram type that routes user-controlled style strings through createCssStyles parser for Mermaid v11.14.0 and earlier captures classDef values with an unrestricted regex:

The value passes unsanitized through addStyleClass() -> createCssStyles() -> style.innerHTML (mermaidAPI.ts:418).

Recommendation

Update the mermaid package to the latest compatible version. Followings are version details:

• Affected version(s): **<= 10.9.5

  >= 11.0.0-alpha.1, <= 11.14.0**

• Patched version(s): **10.9.6

  11.15.0**

References

• GHSA-xcj9-5m2h-648r
• mermaid.js.org
• CVE-2026-41148
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Mermaid: Improper sanitization of configuration leads to CSS injection - CVE-2026-41159
• Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection - CVE-2026-41149
• Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde - CVE-2026-26974
• beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS) - CVE-2026-26226

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

mermaid