npm/mermaid

Mermaid XY Charts are vulnerable to an infinite loop DoS

Modified: 9/10/2026

Mermaid Architecture diagrams are vulnerable to prototype pollution

Modified: 9/10/2026

Cross-site Scripting in Mermaid

Modified: 11/8/2023

Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS

Modified: 9/10/2026

Mermaid allows CSS injection applying to sibling elements of the diagram

Modified: 9/10/2026

Mermaid improperly sanitizes sequence diagram labels leading to XSS

Modified: 8/7/2026

Mermaid: Improper sanitization of configuration leads to CSS injection

Modified: 9/10/2026

Mermaid does not properly sanitize architecture diagram iconText leading to XSS

Modified: 8/7/2026

Mermaid configuration APIs allow prototype pollution

Modified: 9/10/2026

Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

Modified: 9/10/2026

Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify

Modified: 10/23/2024

Incorrect sanitisation function leads to `XSS` in mermaid

Modified: 7/8/2026

Mermaid radar diagrams are vulnerable to DoS

Modified: 9/10/2026

Cross-Site Scripting in mermaid

Modified: 9/27/2021

Possible inject arbitrary `CSS` into the generated graph affecting the container HTML

Modified: 11/8/2023

Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection

Modified: 9/10/2026