mermaid
12.3.0Generation of diagrams like flowcharts or sequence diagrams from text in a similar manner as markdown
- Maintenance
- Active1068 commits in 3 months · bus factor 3
- License
- MITPermissive · OSI-approved
- Security
- 14 advisories2 critical, 2 high, 9 medium, 1 low · Scorecard 6.7/10
- Supported versions
- No scheduleendoflife.date does not track this project
91.1k stars · 9.5k forks · 2.1k open issues · last release 12 days ago · data checked 4 hours ago
Security advisories
All advisories on GitHubThe 14 most recent advisories published by the maintainers: 2 critical, 2 high, 9 medium, 1 low. Check the patched version against the one you run.
- mediumCVE-2026-71439Aug 4, 2026Mermaid radar diagrams are vulnerable to DoS
- Affected
- >=11.6.0, <11.16.1
- Patched in
- 11.16.1
- mediumCVE-2026-50159Aug 4, 2026Mermaid allows CSS injection applying to sibling elements of the diagram
- Affected
- >= 11.0.0-alpha.1, <= 11.16.0; <= 10.9.7
- Patched in
- 11.16.1; 10.9.8
- lowCVE-2026-71438Aug 4, 2026Mermaid configuration APIs allow prototype pollution
- Affected
- >= 11.0.0-alpha.1, <= 11.16.0; <= 10.9.7
- Patched in
- 11.16.1; 10.9.8
- mediumCVE-2026-71436Aug 4, 2026Mermaid XY Charts are vulnerable to an infinite loop DoS
- Affected
- >=10.6.0, <=10.9.7; >= 11.0.0-alpha.1, <= 11.16.0
- Patched in
- 10.9.8; 11.16.1
- mediumCVE-2026-71437Aug 4, 2026Mermaid Architecture diagrams are vulnerable to prototype pollution
- Affected
- >=11.5.0, <=11.16.0
- Patched in
- 11.16.1
- mediumCVE-2026-41159May 11, 2026Improper sanitization of configuration leads to CSS injection
- Affected
- >= 11.0.0-alpha.1, <= 11.14.0; <= 10.9.5
- Patched in
- 11.15.0; 10.9.6
- mediumCVE-2026-41149May 11, 2026Improper sanitization of `classDef` in state diagrams leads to HTML injection
- Affected
- >= 11.0.0-alpha.1, <= 11.14.0; <= 10.9.5
- Patched in
- 11.15.0; 10.9.6
- mediumCVE-2026-41150May 11, 2026Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
- Affected
- >= 11.0.0-alpha.1, <= 11.14.0; <= 10.9.5
- Patched in
- 11.15.0; 10.9.6
- mediumCVE-2026-41148May 11, 2026Improper sanitization of `classDefs` in diagrams leads to CSS injection
- Affected
- >= 11.0.0-alpha.1, <= 11.14.0; <= 10.9.5
- Patched in
- 11.15.0; 10.9.6
- criticalCVE-2025-54880Aug 19, 2025Improper sanitization of architecture diagram iconText leads to XSS
- Affected
- >=11.1.0, <=11.9.0
- Patched in
- 11.10.0
- criticalCVE-2025-54881Aug 19, 2025Improper sanitization of sequence diagram labels leads to XSS
- Affected
- >= 11.0.0-alpha.1, < 11.10.0; >= 10.9.0-rc.1, < 10.9.4
- Patched in
- 11.10.0; 10.9.4
- highCVE-2024-45801Oct 22, 2024Prototype pollution in bundled version of DOMPurify
- Affected
- <= 10.9.2
- Patched in
- 10.9.3, 11.0.0
- mediumCVE-2022-31108Jun 28, 2022Possible inject arbitrary `CSS` into the generated graph affecting the container HTML
- Affected
- 8+
- Patched in
- 9.1.2
- highCVE-2021-43861Dec 29, 2021Incorrect sanitisation function leads to `XSS`
- Affected
- 8.13.6