CVE-2026-41149

CVE-2026-41149 affects Mermaid state diagrams via improper sanitization of the classDef directive, allowing DOM injection that can escape the SVG context. Concrete details: vulnerable in Mermaid versions ≤10.9.5 and 11.0.0-alpha.1–11.14.0; fixed in 10.9.6 and 11.15.0. The issue is mitigated by st...