THREAT OPS › Threat News › [GHSA] GHSA-6x64-9x62-f2gx (medium) — Mermaid allows CSS injection applying to sibling elements of the diagram
[GHSA] GHSA-6x64-9x62-f2gx (medium) — Mermaid allows CSS injection applying to sibling elements of the diagram
GHSA-6x64-9x62-f2gx Severity: medium CVE: CVE-2026-50159
Mermaid allows CSS injection applying to sibling elements of the diagram
### Summary
Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with `#mermaid-X`, sibling (`~` and `+`) combinators can still escape the Mermaid container and inject styles to DOM elements adjacent to the diagram `<svg>`.
MITRE ATT&CK techniques
- JavaScriptT1059.007
Indicators of compromise
- 12d472c9ed43f94814b110da8d7a9ae6dd5266edsha1
- 7e83f1533318b307764d961906a73377266f4c5esha1
- CVE-2026-50159cve
- CVE-2026-41159cve
- https://mermaid.js.org/config/schema-docs/config.html#securitylevelurl
- https://mermaid.js.org/config/schema-docs/config.html#secureurl
Original source: https://github.com/advisories/GHSA-6x64-9x62-f2gx