CVE-2026-50159 Details

A CSS injection vulnerability has been identified in Mermaid, a JavaScript tool for creating diagrams and charts from Markdown-inspired text. This issue affects versions prior to 10.9.8 and 11.16.1. The vulnerability arises from the improper handling of sibling combinator selectors, which can be exploited by injecting arbitrary CSS into the rendered page. An attacker who can supply diagram text may alter the appearance or behavior of unrelated page elements. While most users are not affected, those manually inserting SVG elements into the DOM could be vulnerable.

Users can update to Mermaid versions 10.9.8 or 11.16.1, both of which include the necessary fix. Instructions for downloading these versions are available on the Mermaid GitHub releases page.