CVE-2026-41150CWE-835

Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS

Medium · published May 29, 2026

CVSS v4.0
5.3
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates. mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram). This vulnerability is fixed in 10.9.6 and 11.15.0.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
EPSS
0.00530 · 43.9th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2026-05-29T13:54Z
EPSS history
Timeline
  • 29 MAY 13:54Z
    Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
    cvelistv5