CVE-2026-50159: Mermaid allows CSS injection applying to sibling elements of the diagram
Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with #mermaid-X, sibling (~ and +) combinators can still escape the Mermaid container and inject styles to DOM elements adjacent to the diagram <svg>.
Most users of mermaid would not be affected by this, as mermaid adds its <svg> as an only child of it’s parent element. However, you may be affected if you manually insert the <svg> (or other elements) into the DOM yourself.
References
- github.com/advisories/GHSA-6x64-9x62-f2gx
- github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed
- github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e
- github.com/mermaid-js/mermaid/pull/8022
- github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1
- github.com/mermaid-js/mermaid/releases/tag/v10.9.8
- github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx
- nvd.nist.gov/vuln/detail/CVE-2026-50159
Code Behaviors & Features
Detect and mitigate CVE-2026-50159 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →