mermaid (npm)
Generation of diagrams like flowcharts or sequence diagrams from text in a similar manner as markdown
Advisories
43
Latest version
12.2.0
Released Oct 13, 2026
License
MIT
OpenSSF Scorecard
6.5 / 10
How to fix
Upgrading to 11.16.1 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install mermaid@12.2.0yarn
yarn add mermaid@12.2.0pnpm
pnpm add mermaid@12.2.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-rhh3-jpg6-66xh Mermaid radar diagrams are vulnerable to DoS |
Medium EPSS 0.53% |
>= 11.6.0, < 11.16.1 | 11.16.1 |
| GHSA-rhh3-jpg6-66xh Mermaid radar diagrams are vulnerable to DoS |
Medium EPSS 0.53% |
>= 11.6.0, < 11.16.1 | 11.16.1 |
| GHSA-c4c3-pg64-4m4v Mermaid configuration APIs allow prototype pollution |
Low EPSS 0.35% |
>= 11.0.0-alpha.1, < 11.16.1 | 11.16.1 |
| GHSA-c4c3-pg64-4m4v Mermaid configuration APIs allow prototype pollution |
Low EPSS 0.35% |
>= 11.0.0-alpha.1, < 11.16.1 | 11.16.1 |
| GHSA-c4c3-pg64-4m4v Mermaid configuration APIs allow prototype pollution |
Low EPSS 0.35% |
< 10.9.8 | 10.9.8 |
| GHSA-c4c3-pg64-4m4v Mermaid configuration APIs allow prototype pollution |
Low EPSS 0.35% |
< 10.9.8 | 10.9.8 |
| GHSA-6x64-9x62-f2gx Mermaid allows CSS injection applying to sibling elements of the diagram |
Medium EPSS 0.60% |
< 10.9.8 | 10.9.8 |
| GHSA-6x64-9x62-f2gx Mermaid allows CSS injection applying to sibling elements of the diagram |
Medium EPSS 0.60% |
>= 11.0.0-alpha.1, < 11.16.1 | 11.16.1 |
| GHSA-6x64-9x62-f2gx Mermaid allows CSS injection applying to sibling elements of the diagram |
Medium EPSS 0.60% |
< 10.9.8 | 10.9.8 |
| GHSA-6x64-9x62-f2gx Mermaid allows CSS injection applying to sibling elements of the diagram |
Medium EPSS 0.60% |
>= 11.0.0-alpha.1, < 11.16.1 | 11.16.1 |
| GHSA-3rrr-jr9j-h3q3 Mermaid Architecture diagrams are vulnerable to prototype pollution |
Medium EPSS 0.50% |
>= 11.5.0, < 11.16.1 | 11.16.1 |
| GHSA-3rrr-jr9j-h3q3 Mermaid Architecture diagrams are vulnerable to prototype pollution |
Medium EPSS 0.50% |
>= 11.5.0, < 11.16.1 | 11.16.1 |
| GHSA-2v8p-3f2j-5mp7 Mermaid XY Charts are vulnerable to an infinite loop DoS |
Medium EPSS 0.58% |
>= 11.0.0-alpha.1, < 11.16.1 | 11.16.1 |
| GHSA-2v8p-3f2j-5mp7 Mermaid XY Charts are vulnerable to an infinite loop DoS |
Medium EPSS 0.58% |
>= 10.6.0, < 10.9.8 | 10.9.8 |
| GHSA-2v8p-3f2j-5mp7 Mermaid XY Charts are vulnerable to an infinite loop DoS |
Medium EPSS 0.58% |
>= 11.0.0-alpha.1, < 11.16.1 | 11.16.1 |
| GHSA-2v8p-3f2j-5mp7 Mermaid XY Charts are vulnerable to an infinite loop DoS |
Medium EPSS 0.58% |
>= 10.6.0, < 10.9.8 | 10.9.8 |
| GHSA-87f9-hvmw-gh4p Mermaid: Improper sanitization of configuration leads to CSS injection |
Medium EPSS 0.49% |
< 10.9.6 | 10.9.6 |
| GHSA-87f9-hvmw-gh4p Mermaid: Improper sanitization of configuration leads to CSS injection |
Medium EPSS 0.49% |
>= 11.0.0-alpha.1, <= 11.14.0 | No fix yet |
| GHSA-87f9-hvmw-gh4p Mermaid: Improper sanitization of configuration leads to CSS injection |
Medium EPSS 0.49% |
<= 10.9.5 | No fix yet |
| GHSA-87f9-hvmw-gh4p Mermaid: Improper sanitization of configuration leads to CSS injection |
Medium EPSS 0.49% |
>= 11.0.0-alpha.1, < 11.15.0 | 11.15.0 |
| GHSA-6m6c-36f7-fhxh Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS |
Medium EPSS 0.38% |
>= 11.0.0-alpha.1, < 11.15.0 | 11.15.0 |
| GHSA-6m6c-36f7-fhxh Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS |
Medium EPSS 0.38% |
>= 11.0.0-alpha.1, <= 11.14.0 | No fix yet |
| GHSA-6m6c-36f7-fhxh Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS |
Medium EPSS 0.38% |
<= 10.9.5 | No fix yet |
| GHSA-6m6c-36f7-fhxh Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS |
Medium EPSS 0.38% |
< 10.9.6 | 10.9.6 |
| GHSA-ghcm-xqfw-q4vr Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection |
Medium EPSS 0.40% |
<= 10.9.5 | No fix yet |
| GHSA-ghcm-xqfw-q4vr Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection |
Medium EPSS 0.40% |
>= 11.0.0-alpha.1, < 11.15.0 | 11.15.0 |
| GHSA-ghcm-xqfw-q4vr Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection |
Medium EPSS 0.40% |
>= 11.0.0-alpha.1, <= 11.14.0 | No fix yet |
| GHSA-ghcm-xqfw-q4vr Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection |
Medium EPSS 0.40% |
< 10.9.6 | 10.9.6 |
| GHSA-xcj9-5m2h-648r Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection |
Medium EPSS 0.34% |
<= 10.9.5 | No fix yet |
| GHSA-xcj9-5m2h-648r Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection |
Medium EPSS 0.34% |
>= 11.0.0-alpha.1, < 11.15.0 | 11.15.0 |
| GHSA-xcj9-5m2h-648r Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection |
Medium EPSS 0.34% |
< 10.9.6 | 10.9.6 |
| GHSA-xcj9-5m2h-648r Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection |
Medium EPSS 0.34% |
>= 11.0.0-alpha.1, <= 11.14.0 | No fix yet |
| GHSA-7rqq-prvp-x9jh Mermaid improperly sanitizes sequence diagram labels leading to XSS |
Medium EPSS 0.80% |
>= 11.0.0-alpha.1, < 11.10.0 | 11.10.0 |
| GHSA-7rqq-prvp-x9jh Mermaid improperly sanitizes sequence diagram labels leading to XSS |
Medium EPSS 0.80% |
>= 10.9.0-rc.1, < 10.9.4 | 10.9.4 |
| GHSA-7rqq-prvp-x9jh Mermaid improperly sanitizes sequence diagram labels leading to XSS |
Medium EPSS 0.80% |
>= 11.0.0-alpha.1, < 11.10.0 | 11.10.0 |
| GHSA-7rqq-prvp-x9jh Mermaid improperly sanitizes sequence diagram labels leading to XSS |
Medium EPSS 0.80% |
>= 10.9.0-rc.1, < 10.9.4 | 10.9.4 |
| GHSA-8gwm-58g9-j8pw Mermaid does not properly sanitize architecture diagram iconText leading to XSS |
Medium EPSS 0.41% |
>= 11.1.0, < 11.10.0 | 11.10.0 |
| GHSA-8gwm-58g9-j8pw Mermaid does not properly sanitize architecture diagram iconText leading to XSS |
Medium EPSS 0.41% |
>= 11.1.0, < 11.10.0 | 11.10.0 |
| GHSA-m4gq-x24j-jpmf Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify |
High | < 10.9.3 | 10.9.3 |
| GHSA-x3vm-38hw-55wf Possible inject arbitrary `CSS` into the generated graph affecting the container HTML |
Medium EPSS 0.91% |
>= 8.0.0, < 9.1.2 | 9.1.2 |
| GHSA-p3rp-vmj9-gv6v Incorrect sanitisation function leads to `XSS` in mermaid |
Medium EPSS 0.94% |
< 8.13.8 | 8.13.8 |
| GHSA-4f6x-49g2-99fm Cross-site Scripting in Mermaid |
Medium EPSS 1.02% |
< 8.11.0 | 8.11.0 |
| GHSA-w32g-5hqp-gg6q Cross-Site Scripting in mermaid |
High | < 8.2.3 | 8.2.3 |
Source: git+https://github.com/mermaid-js/mermaid.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor