CVE-2026-41150

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Published

May 29, 2026, 1:54:52 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.38% · Oct 25, 2026

A flaw was found in Mermaid, a JavaScript tool used for creating diagrams and charts. This vulnerability allows a remote attacker to trigger a denial-of-service (DoS) condition. The attack occurs when a specially crafted gantt chart, which uses the `excludes` attribute to exclude all dates, is rendered. Successful exploitation can make the application unresponsive. mermaid: Mermaid: Denial of Service via specially crafted gantt charts Moderate: This denial-of-service vulnerability in Mermaid affects applications that render untrusted gantt charts. Exploitation requires a user to process a specially crafted chart containing an `excludes` attribute that attempts to exclude all dates, leading to application unresponsiveness. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.