Skip to content
Heist/ feed
Unrated

DEBIAN-CVE-2026-41150

Type: advisorySource: OSV1 source record

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates. mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram). This vulnerability is fixed in 10.9.6 and 11.15.0.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-41150

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-41150

node-mermaid

Source reference: /affected/0/package/name

Affected versions
8.11.0+ds+~cs29.13.22-1

Source reference: /affected/0/versions

8.13.2+ds+~cs30.13.21-1

Source reference: /affected/0/versions

8.13.2+ds+~cs30.13.21-1.1

Source reference: /affected/0/versions

8.13.3+ds+~cs26.13.21-1

Source reference: /affected/0/versions

8.13.3+ds+~cs26.13.21-2

Source reference: /affected/0/versions

8.13.8+~cs10.4.16-1

Source reference: /affected/0/versions

8.14.0+ds1+~cs11.4.14-1

Source reference: /affected/0/versions

8.14.0+~cs11.4.14-1

Source reference: /affected/0/versions

8.7.0+ds+~cs27.17.17-1

Source reference: /affected/0/versions

8.7.0+ds+~cs27.17.17-2

Source reference: /affected/0/versions

8.7.0+ds+~cs27.17.17-2~bpo10+1

Source reference: /affected/0/versions

8.7.0+ds+~cs27.17.17-3

Source reference: /affected/0/versions

8.9.1+ds+~cs26.20.25-1

Source reference: /affected/0/versions

8.9.3+ds+~cs29.13.19-1

Source reference: /affected/0/versions

9.2.2+~2.0.0-1

Source reference: /affected/0/versions

9.2.2+~2.0.0-2

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "node-mermaid",
      "purl": "pkg:deb/debian/node-mermaid?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "8.11.0+ds+~cs29.13.22-1",
      "8.13.2+ds+~cs30.13.21-1",
      "8.13.2+ds+~cs30.13.21-1.1",
      "8.13.3+ds+~cs26.13.21-1",
      "8.13.3+ds+~cs26.13.21-2",
      "8.13.8+~cs10.4.16-1",
      "8.14.0+ds1+~cs11.4.14-1",
      "8.14.0+~cs11.4.14-1",
      "8.7.0+ds+~cs27.17.17-1",
      "8.7.0+ds+~cs27.17.17-2",
      "8.7.0+ds+~cs27.17.17-2~bpo10+1",
      "8.7.0+ds+~cs27.17.17-3",
      "8.9.1+ds+~cs26.20.25-1",
      "8.9.3+ds+~cs29.13.19-1",
      "9.2.2+~2.0.0-1",
      "9.2.2+~2.0.0-2"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41150.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#56909 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement