beautiful-mermaid < 0.1.3 SVG Attribute Injection
beautiful-mermaid versions prior to 0.1.3 contain an SVG attribute injection issue that can lead to cross-site scripting (XSS) when rendering attacker-controlled Mermaid diagrams. User-controlled values from Mermaid style and classDef directives are interpolated into SVG attribute values without proper escaping, allowing crafted input to break out of an attribute context and inject arbitrary SVG elements/attributes into the rendered output. When the generated SVG is embedded in a web page, this can result in script execution in the context of the embedding origin.
CVE-2026-26226
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-26226
beautiful-mermaid
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/lukilabs/beautiful-mermaid",
"vendor": "lukilabs",
"product": "beautiful-mermaid",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.1.3",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/beautiful-mermaid",
"packageName": "beautiful-mermaid",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-26226
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #12705 · Revision 1
- Added to Heist Feed
- Publisher date