Denial Of Service

Mermaid is vulnerable to Denial Of Service. The vulnerability is due to an infinite loop in setXAxisRangeData when processing invalid X-Axis parameters, causing array growth that can trigger a RangeError or memory exhaustion and crash the rendering process...

SUSE CVE-2026-50159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

SUSE CVE-2026-71436

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid...

SUSE CVE-2026-71437

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

SUSE CVE-2026-71438

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge caller-supplied configuration into Mermaid's interna...

SUSE CVE-2026-71439

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript...

CVE-2026-71436

A flaw was found in Mermaid XY Charts. A remote attacker could exploit this by providing invalid parameters when configuring an X-Axis. This could lead to an infinite loop, causing a denial of service DoS due to memory exhaustion and potentially crashing the page or JavaScript process. Mitigation...

Linux Distros Unpatched Vulnerability : CVE-2026-71438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration...

Linux Distros Unpatched Vulnerability : CVE-2026-71436

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY...

Linux Distros Unpatched Vulnerability : CVE-2026-71439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagram...

Linux Distros Unpatched Vulnerability : CVE-2026-71437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture...

Linux Distros Unpatched Vulnerability : CVE-2026-50159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CS...

CVE-2026-71439

creationtimestamp| type| source ---|---|--- 2026-08-06 22:35:14+00:00| published-proof-of-concept| https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh...

DEBIAN-CVE-2026-71439

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript...

CVE-2026-71439

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript...

@8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4), @airmix/mcp-excalidraw-server (1.0.6) +203 more potentially affected by CVE-2026-71436 via mermaid (>=10.6.1, <=10.9.5)

mermaid NPM version =10.6.1, =0.18.0-beta.0, =0.17.1-alkemio-5, =1.0.0, =0.18.3, =0.18.0-1, =0.0.1-BETA, =0.18.1, =1.1.4, =0.0.1, =0.0.1, =0.0.1, =7.1.0, =0.114.3, =0.144.2 and more Source cves: CVE-2026-71436 Source advisory: MEND:CVE-2026-71436...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.35), @142vip/vuepress (>=0.0.1-alpha.19, <=0.0.1-alpha.25) +223 more potentially affected by CVE-2026-71436 via mermaid (>=11.0.0, <=11.16.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.1-alpha.19, =0.0.0, =1.1.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.7.9, =0.15.0, =0.25.2 - @changmao/reveal-md 6.1.4-chanmao0.0 and more Source cves: CVE-2026-71436 Source advisory: MEND:CVE-2026-71436...

CVE-2026-71438

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge caller-supplied configuration into Mermaid's interna...

DEBIAN-CVE-2026-71438

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge caller-supplied configuration into Mermaid's interna...

DEBIAN-CVE-2026-71436

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid...