Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-05-29T13:54:52 mermaid: Mermaid: Denial of Service via specially crafted gantt charts 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-835

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates. mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram). This vulnerability is fixed in 10.9.6 and 11.15.0.

A flaw was found in Mermaid, a JavaScript tool used for creating diagrams and charts. This vulnerability allows a remote attacker to trigger a denial-of-service (DoS) condition. The attack occurs when a specially crafted gantt chart, which uses the `excludes` attribute to exclude all dates, is rendered. Successful exploitation can make the application unresponsive.

Moderate: This denial-of-service vulnerability in Mermaid affects applications that render untrusted gantt charts. Exploitation requires a user to process a specially crafted chart containing an `excludes` attribute that attempts to exclude all dates, leading to application unresponsiveness. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Build of Podman Desktop Fix deferred rh-podman-desktop.git Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/code-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-41150 https://nvd.nist.gov/vuln/detail/CVE-2026-41150 https://github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6 https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0 https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6 https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh