CVE-2026-41159

[CVE catalog]

Severity

Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Published

May 29, 2026, 1:53:10 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.49% · Oct 25, 2026

A flaw was found in Mermaid, a JavaScript tool for creating diagrams and charts. A remote attacker could exploit this vulnerability by injecting malicious Cascading Style Sheets (CSS) through specific configuration options, such as fontFamily, themeCSS, and altFontFamily. This injected CSS can bypass the intended scoping, allowing styles to be applied to all elements on a web page, leading to page defacement. Additionally, this flaw enables the exfiltration of sensitive information from the Document Object Model (DOM) using CSS selectors. mermaid: Mermaid: Information disclosure and page defacement via CSS injection This Moderate flaw in Mermaid, a JavaScript diagramming tool, allows for CSS injection that bypasses intended scoping. A remote attacker could exploit this by providing a specially crafted diagram, leading to page defacement and potential exfiltration of sensitive information from the Document Object Model (DOM). This impact is considered Moderate as it requires user interaction to render the malicious content. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.