CVE-2021-43861: Mermaid Project Mermaid

Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days.

Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 to receive a patch. There are no known workarounds aside from upgrading.

Affected products

• Mermaid Project Mermaid: before 8.13.8 (fixed in 8.13.8)

Published 2021-12-30. Last modified 2026-06-17.