Dashboard / CVE-2026-26226

CVE-2026-26226

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 61/100
Published: 2026-02-13 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
AT: None
VC: Low
VI: Low
VA: None

Description

beautiful-mermaid versions prior to 0.1.3 contain an SVG attribute injection issue that can lead to cross-site scripting (XSS) when rendering attacker-controlled Mermaid diagrams. User-controlled values from Mermaid style and classDef directives are interpolated into SVG attribute values without proper escaping, allowing crafted input to break out of an attribute context and inject arbitrary SVG elements/attributes into the rendered output. When the generated SVG is embedded in a web page, this can result in script execution in the context of the embedding origin.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
lukilabs beautiful-mermaid 0 < 0.1.3

References & Advisories (4)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

EPSS — Exploitation Probability

0.56%
Raw Score 0.005650
Percentile 47.5%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00565
2026-11-12
0.00565
2026-11-10
0.00565
2026-11-09
0.00565
2026-11-08
0.00573

Intelligence Sources

mitre ref →

External Links