CVE-2026-41150: Mermaid Project Mermaid

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates. mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram). This vulnerability is fixed in 10.9.6 and 11.15.0.

Affected products

• Mermaid Project Mermaid: before 10.9.6 (fixed in 10.9.6); from 11.0.0, before 11.15.0 (fixed in 11.15.0)

Published 2026-05-29. Last modified 2026-07-21.