CVE-2026-26226: beautiful-mermaid SVG Attribute Injection Leading to XSS
Summary
CVE-2026-26226: beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS). Affects beautiful-mermaid versions < 0.1.3. Fixed in 0.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
beautiful-mermaid is an npm package that allows users to create and render Mermaid diagrams using SVG. It provides a simple way to visualize complex data structures and workflows. However, the package has a vulnerability that allows for SVG attribute injection, which can lead to cross-site scripting (XSS) attacks when rendering diagrams with user-controlled input.
Vulnerability Detail
The vulnerability in beautiful-mermaid arises from improper handling of user-controlled values in the Mermaid style and classDef directives. These values are interpolated directly into SVG attribute values without adequate escaping, allowing attackers to inject arbitrary SVG elements and attributes. This can lead to script execution in the context of the embedding web page, posing a significant security risk to users.
How To Fix
Minimum fixed version
0.1.3
This is the first release that contains the fix.
npm install beautiful-mermaid@0.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using user-controlled input in the style and classDef directives of Mermaid diagrams until you can update to the patched version. This will help mitigate the risk of XSS attacks while you transition to a secure version.
Conclusion
The beautiful-mermaid package has a significant vulnerability that can lead to XSS attacks through SVG attribute injection. It is crucial for users to update to the patched version to mitigate this risk. By following the provided steps and utilizing tools like Vulert, developers can ensure their applications remain secure.
See every vulnerability recorded for beautiful-mermaid →
FAQ
The vulnerability is an SVG attribute injection issue that can lead to cross-site scripting (XSS) when rendering attacker-controlled Mermaid diagrams.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, you can determine if your application is affected by this vulnerability.
Update beautiful-mermaid to version 0.1.3 or later to patch the vulnerability. You can do this using the command: npm install beautiful-mermaid@0.1.3.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
