CVE-2026-50159

Mermaid (JavaScript diagram tool) is affected by a CSS-injection vulnerability caused by sibling combinator selectors generated from diagram-supplied class or id names. The issue exists prior to Mermaid v10.9.8 and v11.16.1 and can allow an attacker who supplies diagram text to inject CSS into th...