CVE-2026-50159: Mermaid CSS Injection Vulnerability Affecting Sibling Elements
Summary
CVE-2026-50159: Mermaid allows CSS injection applying to sibling elements of the diagram. Affects mermaid across 2 version ranges.
< 10.9.8
>= 11.0.0-alpha.1, < 11.16.1
Fixed in 10.9.8 or 11.16.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mermaid is an open-source JavaScript library that enables the generation of diagrams and flowcharts from text descriptions. It is widely used for visualizing complex information in a simple and intuitive manner. The library allows users to create diagrams in various formats, making it a popular choice for documentation and presentations. However, a recent vulnerability has been identified that allows CSS injection, potentially affecting the styling of sibling elements adjacent to the rendered diagrams.
Vulnerability Detail
The vulnerability arises from Mermaid's CSS scoping mechanism, which is intended to restrict styles to the rendered SVG subtree. However, due to the use of sibling combinators in CSS, attackers can exploit this weakness to inject styles into DOM elements that are siblings to the diagram's SVG. This can lead to UI redressing, content hiding, and phishing-style visual manipulation. Although most users may not be affected, those who manually insert SVG elements into the DOM are at risk. Importantly, this vulnerability does not allow for JavaScript execution.
How To Fix
Latest published version: 12.2.0 as of 22 Oct 2026
npm install mermaid@12.2.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 10.9.810.9.8npm install mermaid@10.9.8 -
>= 11.0.0-alpha.1, < 11.16.111.16.1npm install mermaid@11.16.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are manually inserting the SVG into the DOM, you can wrap it in a container element to prevent CSS leakage. For example, use the following code: <div><svg>...</svg></div>. Alternatively, you can utilize Mermaid's built-in functions like mermaid.run() or mermaid.initialize() to handle the SVG insertion correctly. Additionally, setting the configuration option 'securityLevel' to 'sandbox' will prevent this vulnerability.
Conclusion
The CVE-2026-50159 vulnerability in the Mermaid library poses a risk of CSS injection that can affect sibling elements of rendered diagrams. Users are encouraged to update to the latest patched versions and implement recommended workarounds to secure their applications.
See every vulnerability recorded for mermaid →
FAQ
CVE-2026-50159 is a vulnerability in the Mermaid library that allows CSS injection affecting sibling elements of the rendered diagram.
Most users are not affected unless they manually insert SVG elements into the DOM. Those who do are at risk of CSS injection.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground without any signup.
The vulnerability can lead to UI redressing, content hiding, and phishing-style visual manipulation, but does not allow for JavaScript execution.
Update Mermaid to the patched versions (v11.16.1 or v10.9.8) and consider implementing the provided workarounds to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for mermaid.
