Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options. The injected CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping, applying styles to all page elements. Global at-rules (@font-face, @keyframes, @counter-style) are also injectable as stylis hoists them to top level. This allows page defacement and DOM attribute exfiltration via CSS :has() selectors. This vulnerability is fixed in 10.9.6 and 11.15.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.
    Prior to 10.9.6 and 11.15.0, Mermaid's default configuration allows injecting CSS that applies outside of     the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options. The injected     CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping,     applying styles to all page elements. Global at-rules (@font-face, @keyframes, @counter-style) are also     injectable as stylis hoists them to top level. This allows page defacement and DOM attribute exfiltration     via CSS :has() selectors. This vulnerability is fixed in 10.9.6 and 11.15.0. (CVE-2026-41159)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.
    Prior to 10.9.6 and 11.15.0, Mermaid's default configuration allows injecting CSS that applies outside of
    the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options. The injected
    CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping,
    applying styles to all page elements. Global at-rules (@font-face, @keyframes, @counter-style) are also
    injectable as stylis hoists them to top level. This allows page defacement and DOM attribute exfiltration
    via CSS :has() selectors. This vulnerability is fixed in 10.9.6 and 11.15.0. (CVE-2026-41159)

ID	Name	Product	Family	Severity
318018	Linux Distros Unpatched Vulnerability : CVE-2026-41159	Nessus	Misc.	medium
441743	SCA: security update for mermaid (GHSA-87f9-hvmw-gh4p)	Tenable Cloud Security	SCA Checks	medium
441743	SCA: security update for mermaid (GHSA-87f9-hvmw-gh4p)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-41159

medium

Tenable Plugins

medium

medium

medium