Medium
CVE-2026-71439
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 26
Reset filters
Low
CVE-2026-71438
Mermaid configuration APIs allow prototype pollution
Medium
CVE-2026-50159
Mermaid allows CSS injection applying to sibling elements of the diagram
Medium
CVE-2026-71437
Mermaid Architecture diagrams are vulnerable to prototype pollution
Medium
CVE-2026-71436
Mermaid XY Charts are vulnerable to an infinite loop DoS
Medium
CVE-2026-44490
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
Medium
CVE-2026-41159
Mermaid: Improper sanitization of configuration leads to CSS injection
Medium
CVE-2026-41150
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
Medium
CVE-2026-41149
Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection
Medium
CVE-2026-41148
Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection
Medium
CVE-2026-42045
LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution
Medium
ghsa-39h7-pwv7-rc3x
Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)
High
CVE-2026-32308
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
High
CVE-2026-28787
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay
Medium
CVE-2026-26226
beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS)
Critical
CVE-2026-23733
Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)
Medium
CVE-2025-54881
Mermaid improperly sanitizes sequence diagram labels leading to XSS
Medium
CVE-2025-54880
Mermaid does not properly sanitize architecture diagram iconText leading to XSS
High
CVE-2024-49362
Remote Code Execution on click of <a> Link in markdown preview
High
ghsa-m4gq-x24j-jpmf
Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify
Medium
CVE-2024-38527
Cross-site Scripting in ZenUML
Low
CVE-2022-36036
Improper Control of Generation of Code ('Code Injection') in mdx-mermaid
Medium
CVE-2022-31108
Possible inject arbitrary `CSS` into the generated graph affecting the container HTML
High
CVE-2021-43861
Incorrect sanitisation function leads to `XSS` in mermaid
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.