chore(deps): update dependency mermaid to v11.16.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mermaid	11.16.0 → 11.16.1

---

Mermaid XY Charts are vulnerable to an infinite loop DoS

CVE-2026-71436 / GHSA-2v8p-3f2j-5mp7

More information

Details

Impact

Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the setXAxisRangeData(), when configuring an X-Axis with invalid parameters.

As each loop appends an element to an array, this would generally only cause an RangeError: Invalid array length to appear after a few seconds, but may cause the page/JavaScript process to crash due to memory exhaustion, depending on the environment.

Proof-of-concept

xychart
  x-axis 1 --> 1
  line [1, 2]

Patches

This has been patched in mermaid-js/mermaid@630aa7e and released in Mermaid v11.16.1.

A backport has been made for the v10 branch in ef60adc837d9d5107af21285f01e83dea309bd0a and was released in Mermaid v10.9.8

Workarounds

There are no known workarounds. Please update to the latest version or apply the patch.

References

• mermaid-js/mermaid@630aa7e
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
• mermaid-js/mermaid@ef60adc
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289
• https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a
• https://github.com/mermaid-js/mermaid
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid Architecture diagrams are vulnerable to prototype pollution

CVE-2026-71437 / GHSA-3rrr-jr9j-h3q3

More information

Details

Rendering an untrusted architecture-beta diagram lets the diagram author write an arbitrary property with the value horizontal or vertical onto Object.prototype. A group id of __proto__ is accepted as a valid parent.

Impact

Any code in the same realm that reads a property of that name from an arbitrary object, or enumerates an object with bare for...in, observes the injected value (which can only be the string horizontal or vertical.

This may mean corrupted option/config defaults, bypassed truthiness checks, causing denial of service or logic corruption in the embedding application.

Because the injected value cannot be an object or function, this is not directly exploitable for remote code execution.

PoC

architecture-beta
      group mermaidPrototypePollutionMarker(cloud)[Marker]
      service a(server)[A] in __proto__
      service b(server)[B] in mermaidPrototypePollutionMarker
      a:R -- L:b

The vulnerable write was introduced in commit cb0a4703bdf01d47508bde1c08aa9a980d70bc20 and first shipped in mermaid@11.5.0. The lines are unchanged in every release since.

Patches

This has been patched by mermaid-js/mermaid@99af3fc, released in Mermaid v11.16.1

Workarounds

There are no known workarounds. Please update to a patched version.

References

Are there any links users can visit to find out more?

• mermaid-js/mermaid@99af3fc
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-3rrr-jr9j-h3q3
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf
• https://github.com/mermaid-js/mermaid
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid allows CSS injection applying to sibling elements of the diagram

CVE-2026-50159 / GHSA-6x64-9x62-f2gx

More information

Details

Summary

Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with #mermaid-X, sibling (~ and +) combinators can still escape the Mermaid container and inject styles to DOM elements adjacent to the diagram <svg>.

Most users of mermaid would not be affected by this, as mermaid adds its <svg> as an only child of it's parent element. However, you may be affected if you manually insert the <svg> (or other elements) into the DOM yourself.

Details

Mermaid namespaces CSS through with a middleware intended to scope all rules to the diagram's SVG element. CSS nesting expands & ~ * { ... } to #svgId ~ *, which selects all sibling elements following the SVG in the DOM, outside the diagram boundary.

Impact

An attacker able to supply diagram source to a page (e.g., user-generated content rendered by Mermaid) could inject CSS rules affecting sibling elements to the diagram <svg> on the host page. This can be used for UI redressing, hiding content, conditional CSS-based probing, or phishing-style visual manipulation.

JavaScript execution is not possible via this vector.

Patches

This has been patched in mermaid-js/mermaid@12d472c and released in Mermaid v11.16.1.

A backport has been made for the v10 branch in 7e83f1533318b307764d961906a73377266f4c5e and was released in Mermaid v10.9.8

Workarounds

If you are inserting the <svg> into the DOM yourself, you can wrap it in an element with no other children, e.g. <div><svg>...</svg></div> or element.innerHTML = svg. Alternatively, you can use mermaid.run() or mermaid.initialize() which will do this for you.

Setting "securityLevel": "sandbox" will also prevent this, or setting the secure config value in the mermaid config to avoid allowing diagrams to modify fontFamily, themeCSS, altFontFamily, and themeVariables.

To test, you can try using a themeCSS with & + * { /* my CSS here */} and see if it's applied outside of your mermaid <svg>.

---
config:
  themeCSS: |-
    & + * { background:red !important; width:100vw !important; height:100vh !important; position:fixed !important; inset:0 !important; }
---
info

References

• GHSA-87f9-hvmw-gh4p/CVE-2026-41159 (related vulnerability)
• mermaid-js/mermaid@12d472c
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
• mermaid-js/mermaid@7e83f15
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed
• https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e
• https://github.com/mermaid-js/mermaid
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid configuration APIs allow prototype pollution

CVE-2026-71438 / GHSA-c4c3-pg64-4m4v

More information

Details

Summary

Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge the caller-supplied configuration object into Mermaid's internal config using the assignWithDepth deep-merge helper that is vulnerable to prototype pollution.

Because these APIs are intended to receive trusted configuration supplied by the application integrating Mermaid, Mermaid assesses the practical risk as low. The vulnerability is only reachable if an application forwards attacker-controlled data directly into one of these configuration entry points, which is outside their documented usage.

User-controlled configuration (e.g. configuration in diagram code using %%{init: {}}%% or YAML frontmatter) are already protected from prototype pollution.

Patches

This has been patched in mermaid-js/mermaid@2cd6dcf and released in Mermaid v11.16.1.

A backport has been made for the v10 branch in c34b07a0815842327e70794d69b0c8c5a1e2a956 and was released in Mermaid v10.9.8

Impact

Mermaid believes it's unlikely that anybody is impacted, as these functions are configuration entry points expected to receive trusted, developer-controlled values as they can modify other security-relevant configuration.

Workarounds

Don't pass user-controlled data to the mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig functions. Instead, users can use %%{init: {}}%% or YAML frontmatter in diagrams.

Reporters

• liyi.zhou@sydney.edu.au (Liyi), https://lzhou1110.github.io/
• ziyue0530@​gmail.com (Ziyue), https://zyy0530.github.io/
• cshe0476@​uni.sydney.edu.au (Strick), https://str1ckl4nd.github.io/
• chng0012@​uni.sydney.edu.au (Maurice), http://maurice.busystar.org/
• cyu210608@​gmail.com (Chenchen), https://7thparkk.github.io/

Severity

• CVSS Score: 2.4 / 10 (Low)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43
• https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956
• https://github.com/mermaid-js/mermaid
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid radar diagrams are vulnerable to DoS

CVE-2026-71439 / GHSA-rhh3-jpg6-66xh

More information

Details

Impact

Mermaid radar diagrams allow arbitrary large values for ticks, which can cause high CPU usage, freezing the webpage/JavaScript process for long periods of time, until the process is eventually killed due to OOM/running out of memory.

Proof-of-concept

radar-beta
  axis a, b
  curve c {1, 1}
  ticks 1000000000

Patches

Has the problem been patched? What versions should users upgrade to?

This problem has been patched by mermaid-js/mermaid@59b22fa, which was released in Mermaid v11.16.1

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There are no known workarounds without updating to a patched version of mermaid.

References

Are there any links users can visit to find out more?

• mermaid-js/mermaid@59b22fa
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e
• https://github.com/mermaid-js/mermaid
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

mermaid-js/mermaid (mermaid)

v11.16.1

Compare Source

Patch Changes

• #​8022 12d472c Thanks @​aloisklink! - fix: handle CSS sibling combinators in compileCSS

• #​8022 2cd6dcf Thanks @​aloisklink! - fix: increase protections against prototype pollution

  User-controlled input already has protections against prototype pollution.

  Fixes: GHSA-c4c3-pg64-4m4v

• #​8022 99af3fc Thanks @​aloisklink! - fix(architecture): use Maps and Sets to store groups/services

  Services are now rendered in the order they are defined and more service IDs
  are now supported.

• #​8022 2cd6dcf Thanks @​aloisklink! - deprecate: Deprecate the mermaidAPI.setConfig() function

  Calling this function has no observable effect, as the next time a
  render() or parse() is called, the currentConfig is cleared.

• #​8022 630aa7e Thanks @​aloisklink! - fix(xychart): support zero-width x-axis ranges

• #​8022 59b22fa Thanks @​aloisklink! - fix(radar): limit number of ticks to 32

  Setting a ticks value higher than this would only show 32 ticks.

---

Configuration

📅 Schedule: (in timezone Europe/Brussels)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.