Bug 2512365 (CVE-2026-50159)
| Summary: | CVE-2026-50159 mermaid: Mermaid: CSS injection allows altering page elements via diagram input | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | cdrage, rushinde, sdawley |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Mermaid, a JavaScript tool for creating diagrams and charts. An attacker who can provide diagram text can inject arbitrary CSS (Cascading Style Sheets) into the rendered web page. This is possible due to a vulnerability in how sibling combinator selectors are generated from diagram-supplied class or ID names. Successful exploitation could allow the attacker to alter the appearance or behavior of other elements on the page, potentially leading to information disclosure or visual defacement.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-08-06 22:32:13 UTC
|