CVE-2026-50159

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50159", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-03T20:54:20.432Z", "datePublished": "2026-08-06T19:55:27.994Z", "dateUpdated": "2026-08-07T17:18:23.685Z"}, "containers": {"cna": {"title": "Mermaid allows CSS injection applying to sibling elements of the diagram", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx"}, {"name": "https://github.com/mermaid-js/mermaid/pull/8022", "tags": ["x_refsource_MISC"], "url": "https://github.com/mermaid-js/mermaid/pull/8022"}, {"name": "https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed", "tags": ["x_refsource_MISC"], "url": "https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed"}, {"name": "https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e", "tags": ["x_refsource_MISC"], "url": "https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e"}, {"name": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1"}, {"name": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8"}], "affected": [{"vendor": "mermaid-js", "product": "mermaid", "versions": [{"version": "< 10.9.8", "status": "affected"}, {"version": ">= 11.0.0-alpha.1, < 11.16.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T19:55:27.994Z"}, "descriptions": [{"lang": "en", "value": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1."}], "source": {"advisory": "GHSA-6x64-9x62-f2gx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T17:18:05.573812Z", "id": "CVE-2026-50159", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T17:18:23.685Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50159", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T17:18:05.573812Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T17:18:10.914Z"}}], "cna": {"title": "Mermaid allows CSS injection applying to sibling elements of the diagram", "source": {"advisory": "GHSA-6x64-9x62-f2gx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "mermaid-js", "product": "mermaid", "versions": [{"status": "affected", "version": "< 10.9.8"}, {"status": "affected", "version": ">= 11.0.0-alpha.1, < 11.16.1"}]}], "references": [{"url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx", "name": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mermaid-js/mermaid/pull/8022", "name": "https://github.com/mermaid-js/mermaid/pull/8022", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed", "name": "https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e", "name": "https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1", "name": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8", "name": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T19:55:27.994Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50159", "state": "PUBLISHED", "dateUpdated": "2026-08-07T17:18:23.685Z", "dateReserved": "2026-06-03T20:54:20.432Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-06T19:55:27.994Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mermaid", "vendor": "mermaid-js", "versions": [{"status": "affected", "version": "< 10.9.8"}, {"status": "affected", "version": ">= 11.0.0-alpha.1, < 11.16.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1."}, {"lang": "es", "value": "Mermaid es una herramienta de JavaScript que utiliza texto inspirado en Markdown para crear y modificar diagramas y gr\u00e1ficos. Antes de las versiones 10.9.8 y 11.16.1, Mermaid es vulnerable a la inyecci\u00f3n de CSS a trav\u00e9s de selectores combinadores de hermanos generados a partir de nombres de clase o ID proporcionados por el diagrama. Un atacante que puede proporcionar texto de diagrama puede inyectar CSS arbitrario en la p\u00e1gina renderizada, alterando potencialmente la apariencia o el comportamiento de elementos de p\u00e1gina no relacionados. Este problema se ha solucionado en las versiones 10.9.8 y 11.16.1."}], "id": "CVE-2026-50159", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50159", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T17:18:05.573812Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:17:17.180", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed"}, {"source": "security-advisories@github.com", "url": "https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e"}, {"source": "security-advisories@github.com", "url": "https://github.com/mermaid-js/mermaid/pull/8022"}, {"source": "security-advisories@github.com", "url": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8"}, {"source": "security-advisories@github.com", "url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "mermaid: Mermaid: CSS injection allows altering page elements via diagram input", "id": "2512365", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512365"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1.", "A flaw was found in Mermaid, a JavaScript tool for creating diagrams and charts. An attacker who can provide diagram text can inject arbitrary CSS (Cascading Style Sheets) into the rendered web page. This is possible due to a vulnerability in how sibling combinator selectors are generated from diagram-supplied class or ID names. Successful exploitation could allow the attacker to alter the appearance or behavior of other elements on the page, potentially leading to information disclosure or visual defacement."], "mitigation": {"lang": "en:us", "value": "Avoid rendering untrusted or externally-sourced Mermaid diagram definitions in the affected workbench images until the pinned mermaid dependency is upgraded to 11.16.1 or later."}, "name": "CVE-2026-50159", "package_state": [{"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Not affected", "package_name": "rh-podman-desktop.git", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-08-06T19:55:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-50159\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50159\nhttps://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed\nhttps://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e\nhttps://github.com/mermaid-js/mermaid/pull/8022\nhttps://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1\nhttps://github.com/mermaid-js/mermaid/releases/tag/v10.9.8\nhttps://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx"], "statement": "Red Hat ships Mermaid embedded in the same code-server based developer workbench images: OpenShift AI's odh-workbench-codeserver-datascience-cpu-py312 workbench image and OpenShift Dev Spaces' code-rhel9 image. The bundled version (>=11.0.0-alpha.1,<11.16.1) allows an attacker who controls diagram text to inject arbitrary CSS via sibling combinator selectors generated from diagram-supplied class or ID names, altering the appearance of the rendered page.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.9.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0-alpha.1,11.16.1)"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "mermaid", "source": "cna", "vendor": "mermaid-js"}, "product": "mermaid", "vendor": "mermaid_project"}], "created": "2026-08-07T01:15:05.054250+00:00", "updated": "2026-08-11T01:45:06.851017+00:00", "vendors": ["mermaid_project", "mermaid_project$PRODUCT$mermaid"]}