{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50159", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-03T20:54:20.432Z", "datePublished": "2026-08-06T19:55:27.994Z", "dateUpdated": "2026-08-07T17:18:23.685Z"}, "containers": {"cna": {"title": "Mermaid allows CSS injection applying to sibling elements of the diagram", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx"}, {"name": "https://github.com/mermaid-js/mermaid/pull/8022", "tags": ["x_refsource_MISC"], "url": "https://github.com/mermaid-js/mermaid/pull/8022"}, {"name": "https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed", "tags": ["x_refsource_MISC"], "url": "https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed"}, {"name": "https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e", "tags": ["x_refsource_MISC"], "url": "https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e"}, {"name": "https://github.com/mermaid-js/mermaid/releases/tag/[email protected]", "tags": ["x_refsource_MISC"], "url": "https://github.com/mermaid-js/mermaid/releases/tag/[email protected]"}, {"name": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8"}], "affected": [{"vendor": "mermaid-js", "product": "mermaid", "versions": [{"version": "< 10.9.8", "status": "affected"}, {"version": ">= 11.0.0-alpha.1, < 11.16.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T19:55:27.994Z"}, "descriptions": [{"lang": "en", "value": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1."}], "source": {"advisory": "GHSA-6x64-9x62-f2gx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T17:18:05.573812Z", "id": "CVE-2026-50159", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T17:18:23.685Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50159", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T17:18:05.573812Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T17:18:10.914Z"}}], "cna": {"title": "Mermaid allows CSS injection applying to sibling elements of the diagram", "source": {"advisory": "GHSA-6x64-9x62-f2gx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "mermaid-js", "product": "mermaid", "versions": [{"status": "affected", "version": "< 10.9.8"}, {"status": "affected", "version": ">= 11.0.0-alpha.1, < 11.16.1"}]}], "references": [{"url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx", "name": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mermaid-js/mermaid/pull/8022", "name": "https://github.com/mermaid-js/mermaid/pull/8022", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed", "name": "https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e", "name": "https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mermaid-js/mermaid/releases/tag/[email protected]", "name": "https://github.com/mermaid-js/mermaid/releases/tag/[email protected]", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8", "name": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T19:55:27.994Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50159", "state": "PUBLISHED", "dateUpdated": "2026-08-07T17:18:23.685Z", "dateReserved": "2026-06-03T20:54:20.432Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-06T19:55:27.994Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mermaid", "vendor": "mermaid-js", "versions": [{"status": "affected", "version": "< 10.9.8"}, {"status": "affected", "version": ">= 11.0.0-alpha.1, < 11.16.1"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1."}], "id": "CVE-2026-50159", "lastModified": "2026-08-07T18:17:18.830", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "[email protected]", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50159", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T17:18:05.573812Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:17:17.180", "references": [{"source": "[email protected]", "url": "https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed"}, {"source": "[email protected]", "url": "https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e"}, {"source": "[email protected]", "url": "https://github.com/mermaid-js/mermaid/pull/8022"}, {"source": "[email protected]", "url": "https://github.com/mermaid-js/mermaid/releases/tag/[email protected]"}, {"source": "[email protected]", "url": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8"}, {"source": "[email protected]", "url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "[email protected]", "type": "Secondary"}]}

{"bugzilla": {"description": "mermaid: Mermaid: CSS injection allows altering page elements via diagram input", "id": "2512365", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512365"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1.", "A flaw was found in Mermaid, a JavaScript tool for creating diagrams and charts. An attacker who can provide diagram text can inject arbitrary CSS (Cascading Style Sheets) into the rendered web page. This is possible due to a vulnerability in how sibling combinator selectors are generated from diagram-supplied class or ID names. Successful exploitation could allow the attacker to alter the appearance or behavior of other elements on the page, potentially leading to information disclosure or visual defacement."], "mitigation": {"lang": "en:us", "value": "Avoid rendering untrusted or externally-sourced Mermaid diagram definitions in the affected workbench images until the pinned mermaid dependency is upgraded to 11.16.1 or later."}, "name": "CVE-2026-50159", "package_state": [{"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Not affected", "package_name": "rh-podman-desktop.git", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-08-06T19:55:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-50159\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50159\nhttps://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed\nhttps://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e\nhttps://github.com/mermaid-js/mermaid/pull/8022\nhttps://github.com/mermaid-js/mermaid/releases/tag/[email protected]\nhttps://github.com/mermaid-js/mermaid/releases/tag/v10.9.8\nhttps://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx"], "statement": "Red Hat ships Mermaid embedded in the same code-server based developer workbench images: OpenShift AI's odh-workbench-codeserver-datascience-cpu-py312 workbench image and OpenShift Dev Spaces' code-rhel9 image. The bundled version (>=11.0.0-alpha.1,<11.16.1) allows an attacker who controls diagram text to inject arbitrary CSS via sibling combinator selectors generated from diagram-supplied class or ID names, altering the appearance of the rendered page.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.9.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0-alpha.1,11.16.1)"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "mermaid", "source": "cna", "vendor": "mermaid-js"}, "product": "mermaid", "vendor": "mermaid_project"}], "created": "2026-08-07T01:15:05.054250+00:00", "updated": "2026-08-11T01:45:06.851017+00:00", "vendors": ["mermaid_project", "mermaid_project$PRODUCT$mermaid"]}