CVE-2026-41159

{"id": "CVE-2026-41159", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41159", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T15:02:42.708368Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mermaid-js", "product": "mermaid", "versions": [{"status": "affected", "version": ">= 11.0.0-alpha.1, < 11.15.0"}, {"status": "affected", "version": "< 10.9.6"}]}]}], "published": "2026-05-29T15:16:22.813", "references": [{"url": "https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa", "source": "security-advisories@github.com"}, {"url": "https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76", "source": "security-advisories@github.com"}, {"url": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.15.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options. The injected CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping, applying styles to all page elements. Global at-rules (@font-face, @keyframes, @counter-style) are also injectable as stylis hoists them to top level. This allows page defacement and DOM attribute exfiltration via CSS :has() selectors. This vulnerability is fixed in 10.9.6 and 11.15.0."}, {"lang": "es", "value": "Mermaid es una herramienta de JavaScript que utiliza texto inspirado en Markdown para crear y modificar diagramas y gr\u00e1ficos. Antes de las versiones 10.9.6 y 11.15.0, la configuraci\u00f3n predeterminada de Mermaid permite inyectar CSS que se aplica fuera del diagrama de Mermaid a trav\u00e9s de las opciones de configuraci\u00f3n fontFamily, themeCSS y altFontFamily. El CSS inyectado explota el manejo de & (referencia de \u00e1mbito) de stylis. :not(&) escapa el alcance autom\u00e1tico #mermaid-xxx, aplicando estilos a todos los elementos de la p\u00e1gina. Las reglas globales at-rules (@font-face, @keyframes, @counter-style) tambi\u00e9n son inyectables, ya que stylis las eleva al nivel superior. Esto permite la desfiguraci\u00f3n de la p\u00e1gina y la exfiltraci\u00f3n de atributos del DOM a trav\u00e9s de selectores CSS :has(). Esta vulnerabilidad se corrige en las versiones 10.9.6 y 11.15.0."}], "lastModified": "2026-07-21T12:10:00.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mermaid_project:mermaid:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "FDEEC1E5-342A-4D63-9E8E-B3885FD0126B", "versionEndExcluding": "10.9.6"}, {"criteria": "cpe:2.3:a:mermaid_project:mermaid:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "1E9D25F0-A61B-4AE3-8BE6-4246FADCAEFF", "versionEndExcluding": "11.15.0", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}