CVE-2026-41150

Description

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates. mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram). This vulnerability is fixed in 10.9.6 and 11.15.0.

Weakness classification

• security-advisories@github.com: CWE-835

Primary references

• security-advisories@github.com — Patch
• security-advisories@github.com — Patch
• security-advisories@github.com — Release Notes
• security-advisories@github.com — Release Notes
• security-advisories@github.com — Third Party Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Third Party Advisory