Bug 2512365 (CVE-2026-50159)

Summary: CVE-2026-50159 mermaid: Mermaid: CSS injection allows altering page elements via diagram input
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: cdrage, rushinde, sdawley
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Mermaid, a JavaScript tool for creating diagrams and charts. An attacker who can provide diagram text can inject arbitrary CSS (Cascading Style Sheets) into the rendered web page. This is possible due to a vulnerability in how sibling combinator selectors are generated from diagram-supplied class or ID names. Successful exploitation could allow the attacker to alter the appearance or behavior of other elements on the page, potentially leading to information disclosure or visual defacement.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-06 22:32:13 UTC
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1.