chore(deps): update dependency mermaid to v11.16.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mermaid	11.15.0 → 11.16.1

---

Mermaid XY Charts are vulnerable to an infinite loop DoS

CVE-2026-71436 / GHSA-2v8p-3f2j-5mp7

More information

Details

Impact

Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the setXAxisRangeData(), when configuring an X-Axis with invalid parameters.

As each loop appends an element to an array, this would generally only cause an RangeError: Invalid array length to appear after a few seconds, but may cause the page/JavaScript process to crash due to memory exhaustion, depending on the environment.

Proof-of-concept

xychart
  x-axis 1 --> 1
  line [1, 2]

Patches

This has been patched in mermaid-js/mermaid@630aa7e and released in Mermaid v11.16.1.

A backport has been made for the v10 branch in ef60adc837d9d5107af21285f01e83dea309bd0a and was released in Mermaid v10.9.8

Workarounds

There are no known workarounds. Please update to the latest version or apply the patch.

References

• mermaid-js/mermaid@630aa7e
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
• mermaid-js/mermaid@ef60adc
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289
• https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a
• https://github.com/mermaid-js/mermaid
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid Architecture diagrams are vulnerable to prototype pollution

CVE-2026-71437 / GHSA-3rrr-jr9j-h3q3

More information

Details

Rendering an untrusted architecture-beta diagram lets the diagram author write an arbitrary property with the value horizontal or vertical onto Object.prototype. A group id of __proto__ is accepted as a valid parent.

Impact

Any code in the same realm that reads a property of that name from an arbitrary object, or enumerates an object with bare for...in, observes the injected value (which can only be the string horizontal or vertical.

This may mean corrupted option/config defaults, bypassed truthiness checks, causing denial of service or logic corruption in the embedding application.

Because the injected value cannot be an object or function, this is not directly exploitable for remote code execution.

PoC

architecture-beta
      group mermaidPrototypePollutionMarker(cloud)[Marker]
      service a(server)[A] in __proto__
      service b(server)[B] in mermaidPrototypePollutionMarker
      a:R -- L:b

The vulnerable write was introduced in commit cb0a4703bdf01d47508bde1c08aa9a980d70bc20 and first shipped in mermaid@11.5.0. The lines are unchanged in every release since.

Patches

This has been patched by mermaid-js/mermaid@99af3fc, released in Mermaid v11.16.1

Workarounds

There are no known workarounds. Please update to a patched version.

References

Are there any links users can visit to find out more?

• mermaid-js/mermaid@99af3fc
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-3rrr-jr9j-h3q3
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf
• https://github.com/mermaid-js/mermaid
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid allows CSS injection applying to sibling elements of the diagram

CVE-2026-50159 / GHSA-6x64-9x62-f2gx

More information

Details

Summary

Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with #mermaid-X, sibling (~ and +) combinators can still escape the Mermaid container and inject styles to DOM elements adjacent to the diagram <svg>.

Most users of mermaid would not be affected by this, as mermaid adds its <svg> as an only child of it's parent element. However, you may be affected if you manually insert the <svg> (or other elements) into the DOM yourself.

Details

Mermaid namespaces CSS through with a middleware intended to scope all rules to the diagram's SVG element. CSS nesting expands & ~ * { ... } to #svgId ~ *, which selects all sibling elements following the SVG in the DOM, outside the diagram boundary.

Impact

An attacker able to supply diagram source to a page (e.g., user-generated content rendered by Mermaid) could inject CSS rules affecting sibling elements to the diagram <svg> on the host page. This can be used for UI redressing, hiding content, conditional CSS-based probing, or phishing-style visual manipulation.

JavaScript execution is not possible via this vector.

Patches

This has been patched in mermaid-js/mermaid@12d472c and released in Mermaid v11.16.1.

A backport has been made for the v10 branch in 7e83f1533318b307764d961906a73377266f4c5e and was released in Mermaid v10.9.8

Workarounds

If you are inserting the <svg> into the DOM yourself, you can wrap it in an element with no other children, e.g. <div><svg>...</svg></div> or element.innerHTML = svg. Alternatively, you can use mermaid.run() or mermaid.initialize() which will do this for you.

Setting "securityLevel": "sandbox" will also prevent this, or setting the secure config value in the mermaid config to avoid allowing diagrams to modify fontFamily, themeCSS, altFontFamily, and themeVariables.

To test, you can try using a themeCSS with & + * { /* my CSS here */} and see if it's applied outside of your mermaid <svg>.

---
config:
  themeCSS: |-
    & + * { background:red !important; width:100vw !important; height:100vh !important; position:fixed !important; inset:0 !important; }
---
info

References

• GHSA-87f9-hvmw-gh4p/CVE-2026-41159 (related vulnerability)
• mermaid-js/mermaid@12d472c
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
• mermaid-js/mermaid@7e83f15
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed
• https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e
• https://github.com/mermaid-js/mermaid
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid configuration APIs allow prototype pollution

CVE-2026-71438 / GHSA-c4c3-pg64-4m4v

More information

Details

Summary

Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge the caller-supplied configuration object into Mermaid's internal config using the assignWithDepth deep-merge helper that is vulnerable to prototype pollution.

Because these APIs are intended to receive trusted configuration supplied by the application integrating Mermaid, Mermaid assesses the practical risk as low. The vulnerability is only reachable if an application forwards attacker-controlled data directly into one of these configuration entry points, which is outside their documented usage.

User-controlled configuration (e.g. configuration in diagram code using %%{init: {}}%% or YAML frontmatter) are already protected from prototype pollution.

Patches

This has been patched in mermaid-js/mermaid@2cd6dcf and released in Mermaid v11.16.1.

A backport has been made for the v10 branch in c34b07a0815842327e70794d69b0c8c5a1e2a956 and was released in Mermaid v10.9.8

Impact

Mermaid believes it's unlikely that anybody is impacted, as these functions are configuration entry points expected to receive trusted, developer-controlled values as they can modify other security-relevant configuration.

Workarounds

Don't pass user-controlled data to the mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig functions. Instead, users can use %%{init: {}}%% or YAML frontmatter in diagrams.

Reporters

• liyi.zhou@sydney.edu.au (Liyi), https://lzhou1110.github.io/
• ziyue0530@​gmail.com (Ziyue), https://zyy0530.github.io/
• cshe0476@​uni.sydney.edu.au (Strick), https://str1ckl4nd.github.io/
• chng0012@​uni.sydney.edu.au (Maurice), http://maurice.busystar.org/
• cyu210608@​gmail.com (Chenchen), https://7thparkk.github.io/

Severity

• CVSS Score: 2.4 / 10 (Low)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43
• https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956
• https://github.com/mermaid-js/mermaid
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid radar diagrams are vulnerable to DoS

CVE-2026-71439 / GHSA-rhh3-jpg6-66xh

More information

Details

Impact

Mermaid radar diagrams allow arbitrary large values for ticks, which can cause high CPU usage, freezing the webpage/JavaScript process for long periods of time, until the process is eventually killed due to OOM/running out of memory.

Proof-of-concept

radar-beta
  axis a, b
  curve c {1, 1}
  ticks 1000000000

Patches

Has the problem been patched? What versions should users upgrade to?

This problem has been patched by mermaid-js/mermaid@59b22fa, which was released in Mermaid v11.16.1

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There are no known workarounds without updating to a patched version of mermaid.

References

Are there any links users can visit to find out more?

• mermaid-js/mermaid@59b22fa
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e
• https://github.com/mermaid-js/mermaid
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

mermaid-js/mermaid (mermaid)

v11.16.1

Compare Source

Patch Changes

• #​8022 12d472c Thanks @​aloisklink! - fix: handle CSS sibling combinators in compileCSS

• #​8022 2cd6dcf Thanks @​aloisklink! - fix: increase protections against prototype pollution

  User-controlled input already has protections against prototype pollution.

  Fixes: GHSA-c4c3-pg64-4m4v

• #​8022 99af3fc Thanks @​aloisklink! - fix(architecture): use Maps and Sets to store groups/services

  Services are now rendered in the order they are defined and more service IDs
  are now supported.

• #​8022 2cd6dcf Thanks @​aloisklink! - deprecate: Deprecate the mermaidAPI.setConfig() function

  Calling this function has no observable effect, as the next time a
  render() or parse() is called, the currentConfig is cleared.

• #​8022 630aa7e Thanks @​aloisklink! - fix(xychart): support zero-width x-axis ranges

• #​8022 59b22fa Thanks @​aloisklink! - fix(radar): limit number of ticks to 32

  Setting a ticks value higher than this would only show 32 ticks.

v11.16.0

Compare Source

Minor Changes

• #​7535 ea1c48f Thanks @​ragelink! - feat(cynefin): Adds the Cynefin framework as a new diagram type (beta) to Mermaid (available as cynefin-beta). The Cynefin framework, created by Dave Snowden, is a decision-making framework that categorizes problems into five complexity domains, widely used in agile, incident management, strategy, and organizational design.

• #​7721 f45cc2c Thanks @​notionparallax! - feat(treeView): add box-drawing character input support for treeView diagrams

• #​7550 f1f4d45 Thanks @​DominicBurkart! - feat(xychart): add per-point text labels for xychart line plots

• #​7527 b4d0442 Thanks @​notionparallax! - feat(treeView): Extends the existing treeView-beta diagram with features useful for representing file/directory structures.

• #​7793 a6f097d Thanks @​SSDWGG! - feat(er): support optional ER attribute types with a ? suffix

• #​7772 37f2e36 Thanks @​devareddy05! - feat(gantt): support multiple excludes / includes lines so long exclusion lists can be split into commented groups (#​6270)

• #​7708 4e63e9d Thanks @​txmxthy! - feat(architecture): add align row|column {ids…} directive to architecture-beta diagrams so authors can declare horizontal or vertical alignment of services explicitly.

• #​7760 05223be Thanks @​ngdaniels! - feat(pie): Enhance Pie Chart - Enable donut chart, Set legend position, and highlight slice

• #​7251 216e4e9 Thanks @​ydah! - feat(railroad): Add support for Railroad Diagrams (Syntax Diagrams) with four input syntaxes: IR (railroad-beta), EBNF (railroad-ebnf-beta), ABNF (railroad-abnf-beta), and PEG (railroad-peg-beta).

• #​7774 e5c75e6 Thanks @​ngdaniels! - feat(xychart): enable rotate label on X-axis

• #​7791 974fa7b Thanks @​knsv-bot! - feat(swimlane): add swimlane as a standalone diagram type with a dedicated layered orthogonal layout algorithm

Patch Changes

• #​7744 633c261 Thanks @​ashishjain0512! - fix(architecture): add architecture.seed config option to make architecture diagrams render deterministically. Resolves #​7729.

• #​7732 c8ba156 Thanks @​rkdfx! - fix: tolerate leading horizontal whitespace before YAML frontmatter delimiters. Closes #​7613

• #​7314 4e4e6c4 Thanks @​darshanr0107! - fix(flowchart): Prevent crash when flowchart node shape is undefined

• #​7762 cfd2391 Thanks @​Dharya-dev! - fix(class): support styling and callbacks for generic classes

• #​7284 c1f116d Thanks @​darshanr0107! - fix(gantt): Render gantt vertical markers without affecting row layout or chart height

• #​7786 72fbab1 Thanks @​knsv-bot! - fix(er): allow special characters (e.g. dots) in ER diagram attribute names and types by escaping them with backticks

• #​7672 4887e97 Thanks @​sjackson0109! - fix(flowchart): respect per-subgraph direction keyword in Dagre layout. Fixes #​4648

• #​7734 a4c1e50 Thanks @​OfirHaf! - fix(block): read block padding and sanitize config dynamically instead of at module load time

• #​7674 cc75089 Thanks @​cyphercodes! - fix(block): respect current DOMPurify config when sanitizing labels

• #​7711 be2e282 Thanks @​Jinacker! - fix(flowchart): render flowchart and state self-loop edges as a single SVG path.

• #​7781 d945968 Thanks @​Dharya-dev! - fix(radar): align axis labels based on angular position to prevent clipping

• #​7661 2f5e9e8 Thanks @​nabila401! - fix(venn): fix 3-circle venn diagram union rendering

• #​7780 8dcdce4 Thanks @​Dharya-dev! - fix(xychart): truncate plot data to match x-axis category count

• #​7235 1bbc189 Thanks @​darshanr0107! - fix: Support consecutive LaTeX in node text

• #​7247 365c1b1 Thanks @​darshanr0107! - fix(treeView): Ensure treemap labels render correctly in large nested diagrams

• #​7754 06a32b7 Thanks @​palgunatm66! - fix(sequence): sequenceDiagram rect backgrounds using theme-aware fallback colors

• #​7693 afaf306 Thanks @​dull-bird! - fix(quadrant-chart): allow CJK, emoji, Latin-1 accented characters, and other non-ASCII text in unquoted axis/quadrant/point labels. Fixes #​7120.

• #​7751 79e97cd Thanks @​puneetdixit200! - fix(state): render state diagram click tooltips with mermaidTooltip

• #​7570 c2305df Thanks @​PinguinsRule! - fix(state): Fix invalid syntax between state and '{'

• #​7758 a4a250b Thanks @​mk24x7! - fix(venn): render labeled higher-arity unions when the underlying pairwise unions are not declared. Resolves #​7656.

• Updated dependencies [ea1c48f, b4d0442, 4e63e9d, 216e4e9]:

  • @​mermaid-js/parser@​1.2.0

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • Monday through Friday (* * * * 1-5)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 39, reused 0, downloaded 0, added 0
Progress: resolved 70, reused 0, downloaded 0, added 0
Progress: resolved 72, reused 0, downloaded 0, added 0
Progress: resolved 129, reused 0, downloaded 0, added 0
 ERR_PNPM_TRUST_DOWNGRADE  High-risk trust downgrade for "chokidar@4.0.3" (possible package takeover)

This error happened while installing the dependencies of sass@1.99.0

Trust checks are based solely on publish date, not semver. A package cannot be installed if any earlier-published version had stronger trust evidence. Earlier versions had provenance attestation, but this version has no trust evidence. A trust downgrade may indicate a supply chain incident.
Progress: resolved 243, reused 0, downloaded 0, added 0