GHSA-6m6c-36f7-fhxh CVE-2026-41150

Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS

Medium npm

Severity: 5.3 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): 0.38%; Chance of exploitation in the next 30 days. Higher than 32.50% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Fix: 11.15.0; Upgrade mermaid to this version or later

Description

Impact

Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates.

Example:

gantt
  excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday
  DoS :2025-01-01, 1d

mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram).

Patches

This has been patched in:

Workarounds

There are no workarounds available without updating to a newer version of mermaid.

Affected versions

npm

Package	Vulnerable	Fixed in
mermaid	`>= 11.0.0-alpha.1, <= 11.14.0`	No fix yet
mermaid	`<= 10.9.5`	No fix yet
mermaid	`>= 11.0.0-alpha.1, < 11.15.0`	`11.15.0`
mermaid	`< 10.9.6`	`10.9.6`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

mermaid npm → `11.15.0`

npm

npm install mermaid@11.15.0

yarn

yarn add mermaid@11.15.0

pnpm

pnpm add mermaid@11.15.0

Severity breakdown

CVSS 4.0 5.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: Passive
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): Low
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): Low

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

Weakness

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References

Advisories

Fixes and patches

Packages

github.com/mermaid-js/mermaid

Timeline

May 11, 2026 Published
Sep 10, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-rhh3-jpg6-66xh Mermaid radar diagrams are vulnerable to DoS	Medium	Also affects mermaid
GHSA-c4c3-pg64-4m4v Mermaid configuration APIs allow prototype pollution	Low	Also affects mermaid
GHSA-6x64-9x62-f2gx Mermaid allows CSS injection applying to sibling elements of the diagram	Medium	Also affects mermaid
GHSA-3rrr-jr9j-h3q3 Mermaid Architecture diagrams are vulnerable to prototype pollution	Medium	Also affects mermaid
GHSA-2v8p-3f2j-5mp7 Mermaid XY Charts are vulnerable to an infinite loop DoS	Medium	Also affects mermaid
GHSA-87f9-hvmw-gh4p Mermaid: Improper sanitization of configuration leads to CSS injection	Medium	Also affects mermaid
GHSA-ghcm-xqfw-q4vr Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection	Medium	Also affects mermaid
GHSA-xcj9-5m2h-648r Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection	Medium	Also affects mermaid

Credits: Twavesx, aloisklink

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor