{"kind": "product", "path": "vulns/npm/mermaid", "name": "mermaid", "product": "mermaid", "ecosystem": "npm", "items": [{"id": "CVE-2026-71439", "noindex": false, "published": "2026-08-06T20:01:04.423Z", "modified": "2026-08-07T17:09:23.203Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L", "severity": "medium", "epss": 0.00528, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-71439", "title": "Mermaid radar diagrams are vulnerable to DoS", "description": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript process for long periods of time, potentially until the process is killed from memory exhaustion. This issue is fixed in version 11.16.1.", "references": ["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh", "https://github.com/mermaid-js/mermaid/pull/8022", "https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e"], "fixes": ["11.16.1"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "CVE-2026-71438", "noindex": false, "published": "2026-08-06T19:59:07.450Z", "modified": "2026-08-07T15:40:29.335Z", "cvss": 2.4, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H", "severity": "low", "epss": 0.00353, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-71438", "title": "Mermaid configuration APIs allow prototype pollution", "description": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge caller-supplied configuration into Mermaid's internal config using the assignWithDepth deep-merge helper, which is vulnerable to prototype pollution. This is only exploitable if an application forwards untrusted data directly into one of these configuration entry points, which is outside their documented usage; diagram-supplied configuration (e.g. %%{init: {}}%% or YAML frontmatter) is not affected. ", "references": ["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v", "https://github.com/mermaid-js/mermaid/pull/8022", "https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43"], "fixes": ["10.9.8", "11.16.1"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}, {"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "CVE-2026-50159", "noindex": false, "published": "2026-08-06T19:55:27.994Z", "modified": "2026-08-07T17:18:23.685Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L", "severity": "medium", "epss": 0.00603, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-50159", "title": "Mermaid allows CSS injection applying to sibling elements of the diagram", "description": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1.", "references": ["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx", "https://github.com/mermaid-js/mermaid/pull/8022", "https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed"], "fixes": ["10.9.8", "11.16.1"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}, {"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "CVE-2026-71437", "noindex": false, "published": "2026-08-06T19:51:52.975Z", "modified": "2026-08-07T17:37:35.933Z", "cvss": 6.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H", "severity": "medium", "epss": 0.00503, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-71437", "title": "Mermaid Architecture diagrams are vulnerable to prototype pollution", "description": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of __proto__. Because the group id is used directly as an object property key without validation, an attacker who can supply diagram text can pollute Object.prototype, potentially affecting the behavior of the embedding application. This issue is fixed in version 11.16.1.", "references": ["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-3rrr-jr9j-h3q3", "https://github.com/mermaid-js/mermaid/pull/8022", "https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf"], "fixes": ["11.16.1"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "CVE-2026-71436", "noindex": false, "published": "2026-08-06T19:49:44.739Z", "modified": "2026-08-07T16:17:15.115Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L", "severity": "medium", "epss": 0.00581, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-71436", "title": "Mermaid XY Charts are vulnerable to an infinite loop DoS", "description": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid parameters. Because each loop iteration appends an element to an array, this generally causes a RangeError to appear after a few seconds, but it may instead cause the page or JavaScript process to crash from memory exhaustion, depending on the environment. This issue is fixed in versions 10.9.8 and 11.16.1.", "references": ["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7", "https://github.com/mermaid-js/mermaid/pull/8022", "https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289"], "fixes": ["10.9.8", "11.16.1"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}, {"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "CVE-2026-41150", "noindex": false, "published": "2026-05-29T13:54:52.157Z", "modified": "2026-05-29T16:17:31.324Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L", "severity": "medium", "epss": 0.00384, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-41150", "title": "Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS", "description": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates. mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram). This vulnerability is fixed in 10.9.6 and 11.15.0.", "references": ["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh", "https://github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6", "https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e"], "fixes": ["10.9.6", "11.15.0"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}, {"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "CVE-2026-41159", "noindex": false, "published": "2026-05-29T13:53:10.148Z", "modified": "2026-07-01T19:21:36.047Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L", "severity": "medium", "epss": 0.00486, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-41159", "title": "Mermaid: Improper sanitization of configuration leads to CSS injection", "description": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0,  Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options. The injected CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping, applying styles to all page elements. Global at-rules (@font-face, @keyframes, @counter-style) are also injectable as stylis hoists them to top level. This allows page defacement and DOM attribute exfiltration via CSS :has() select", "references": ["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p", "https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa", "https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76"], "fixes": ["10.9.6", "11.15.0"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}, {"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "CVE-2026-41149", "noindex": false, "published": "2026-05-22T22:34:36.944Z", "modified": "2026-05-23T03:22:44.013Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L", "severity": "medium", "epss": 0.00401, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-41149", "title": "Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection", "description": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, <script> tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting \"securityLevel\": \"sandbox\", which prevents the issue by renderi", "references": ["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr", "https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056", "https://github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3"], "fixes": ["10.9.6", "11.15.0"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}, {"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "CVE-2026-41148", "noindex": false, "published": "2026-05-22T22:03:50.872Z", "modified": "2026-05-27T13:25:35.445Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L", "severity": "medium", "epss": 0.00338, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-41148", "title": "Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection", "description": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and prior, in addition to 11.0.0-alpha.1 through 11.12.0 are vulnerable to CSS injection through improper sanitization. The state diagram (and any other diagram type that routes user-controlled style strings through the createCssStyles parser) captures classDef values using an unrestricted regex that matches everything up to a newline. That value then flows unsanitized through addStyleClass() into createCssStyles() and is assigned to style.innerHTML, so a closing brace (}) in the value terminates the generated CSS selector a", "references": ["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r", "https://github.com/mermaid-js/mermaid/commit/8fead23c59166b7bab6a39eac81acebee2859102", "https://github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f"], "fixes": ["10.9.6", "11.15.0"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}, {"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "CVE-2025-54881", "noindex": false, "published": "2025-08-19T17:04:29.453Z", "modified": "2025-08-19T18:14:04.599Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00799, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-54881", "title": "Mermaid improperly sanitizes of sequence diagram labels leading to XSS", "description": "Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 10.9.0-rc.1 to 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS.", "references": ["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh", "https://github.com/mermaid-js/mermaid/commit/5c69e5fdb004a6d0a2abe97e23d26e223a059832", "https://github.com/mermaid-js/mermaid/commit/685516a85ec1df64cefd4fd15f26533be87d458e"], "fixes": ["10.9.4", "11.10.0"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}, {"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "CVE-2025-54880", "noindex": false, "published": "2025-08-19T16:58:41.120Z", "modified": "2025-08-19T17:09:32.759Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.0041, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-54880", "title": "Mermaid does not properly sanitize architecture diagram iconText leading to XSS", "description": "Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting. This vulnerability is fixed in 11.10.0.", "references": ["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw", "https://github.com/mermaid-js/mermaid/commit/2aa83302795183ea5c65caec3da1edd6cb4791fc", "https://github.com/mermaid-js/mermaid/commit/734bde38777c9190a5a72e96421c83424442d4e4"], "fixes": ["11.10.0"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "GHSA-m4gq-x24j-jpmf", "noindex": false, "published": "2024-10-22T18:17:02Z", "modified": "2024-10-23T14:24:24Z", "cvss": 7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/ghsa-m4gq-x24j-jpmf", "title": "Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify", "description": "The following bundled files within the Mermaid NPM package contain a bundled version of DOMPurify that is vulnerable to https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674, potentially resulting in an XSS attack.\n\nThis affects the built:\n\n- `dist/mermaid.min.js`\n- `dist/mermaid.js`\n- `dist/mermaid.esm.mjs`\n- `dist/mermaid.esm.min.mjs`\n\nThis will also affect users that use the above files via a CDN link, e.g. `https://cdn.jsdelivr.net/npm/mermaid@10.9.2/dist/mermaid.min.js`\n\n**Users that use the default NPM export of `mermaid`, e.g. `import mermaid from 'mermaid'`, or the `dist/mermaid.core.mjs` file, do not use this bu", "references": ["https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674", "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-m4gq-x24j-jpmf", "https://github.com/mermaid-js/mermaid/commit/6c785c93166c151d27d328ddf68a13d9d65adc00"], "fixes": ["10.9.3"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "CVE-2022-31108", "noindex": false, "published": "2022-06-28T18:35:11.000Z", "modified": "2025-04-22T17:52:58.513Z", "cvss": 4.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", "severity": "medium", "epss": 0.00914, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2022-31108", "title": "Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js", "description": "Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary `CSS` into the generated graph allowing them to change the styling of elements outside of the generated graph, and potentially exfiltrate sensitive information by using specially crafted `CSS` selectors. The following example shows how an attacker can exfiltrate the contents of an input field by bruteforcing the `value` attribute one character at a time. Whenever there is an actual match, an `http` request will be made by the browser in order to \"", "references": ["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-x3vm-38hw-55wf", "https://github.com/mermaid-js/mermaid/commit/0ae1bdb61adff1cd485caff8c62ec6b8ac57b225", "https://nvd.nist.gov/vuln/detail/CVE-2022-31108"], "fixes": ["9.1.2"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "CVE-2021-43861", "noindex": false, "published": "2021-12-30T13:40:11.000Z", "modified": "2024-08-04T04:10:17.137Z", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00938, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2021-43861", "title": "Incorrect sanitisation function leads to `XSS`", "description": "Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 to receive a patch. There are no known workarounds aside from upgrading.", "references": ["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-p3rp-vmj9-gv6v", "https://github.com/mermaid-js/mermaid/commit/066b7a0d0bda274d94a2f2d21e4323dab5776d83", "https://github.com/mermaid-js/mermaid/releases/tag/8.13.8"], "fixes": ["8.13.8"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "CVE-2021-35513", "noindex": false, "published": "2021-06-27T11:03:30.000Z", "modified": "2024-08-04T00:40:47.091Z", "cvss": 6.1, "cvss_vector": "", "severity": "medium", "epss": 0.01018, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2021-35513", "title": "CVE-2021-35513", "description": "Mermaid before 8.11.0 allows XSS when the antiscript feature is used.", "references": ["https://github.com/mermaid-js/mermaid/issues/2122", "https://github.com/mermaid-js/mermaid/pull/2123", "https://github.com/mermaid-js/mermaid/releases/tag/8.11.0-rc2"], "fixes": ["8.11.0"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}, {"id": "GHSA-w32g-5hqp-gg6q", "noindex": false, "published": "2020-09-02T15:41:41Z", "modified": "2021-09-27T13:34:07Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/ghsa-w32g-5hqp-gg6q", "title": "Cross-Site Scripting in mermaid", "description": "Versions of `mermaid` prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input  such as `A[\"<img src=invalid onerror=alert('XSS')></img>\"] ` is provided to the application, it will execute the code instead of rendering it as text due to improper output encoding.\n\n\n## Recommendation\n\nUpgrade to version 8.2.3 or later", "references": ["https://github.com/knsv/mermaid/issues/847", "https://github.com/knsv/mermaid", "https://www.npmjs.com/advisories/751"], "fixes": ["8.2.3"], "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}]}], "total": 16, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "mermaid", "path": "vulns/npm/mermaid", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-08-07T17:37:35.933Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}