Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.
    Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors
    generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject
    arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page
    elements. This issue is fixed in versions 10.9.8 and 11.16.1. (CVE-2026-50159)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.
    Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors     generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject     arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page     elements. This issue is fixed in versions 10.9.8 and 11.16.1. (CVE-2026-50159)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
445757	SCA: security update for mermaid (GHSA-6x64-9x62-f2gx)	Tenable Cloud Security	SCA Checks	Local	medium
445757	SCA: security update for mermaid (GHSA-6x64-9x62-f2gx)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
333317	Linux Distros Unpatched Vulnerability : CVE-2026-50159	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-50159

medium

Tenable Plugins

medium

medium

medium