github.com/mermaid-js/mermaid
Submitted 8/4/2026, 10:25:54 AM · Status: ok
Risk grade
F
100 / 100
Findings
260
2 critical66 high179 medium13 low0 info0 on CISA KEV0ATT&CK
Showing 260 of 260 findings
Findings
- shell-quote quote() does not escape newlines in object .op valuesgrypeCVE-2026-9277EPSS 0.9%
- websocket-driver: Message corruption via abuse of protocol length headersgrypeCVE-2026-54466EPSS 0.3%
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Axios Node HTTP adapter can use an inherited proxy after interceptor config cloninggrype
- brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsgrypeCVE-2026-13149EPSS 0.3%
- brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsgrypeCVE-2026-13149EPSS 0.3%
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashgrypeCVE-2026-14257EPSS 0.3%
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashgrypeCVE-2026-14257EPSS 0.3%
- defu: Prototype pollution via `__proto__` key in defaults argumentgrypeCVE-2026-35209EPSS 0.4%
- fast-uri vulnerable to host confusion via failed IDN canonicalizationgrypeCVE-2026-13676EPSS 0.4%
- fast-uri vulnerable to host confusion via literal backslash authority delimitergrypeCVE-2026-16221EPSS 0.2%
- fast-uri vulnerable to host confusion via percent-encoded authority delimitersgrypeCVE-2026-6322EPSS 0.5%
- fast-uri vulnerable to path traversal via percent-encoded dot segmentsgrypeCVE-2026-6321EPSS 0.5%
- find-my-way: DDoS with HTTP2grypeCVE-2026-47219
- flatted vulnerable to unbounded recursion DoS in parse() revive phasegrypeCVE-2026-32141EPSS 0.8%
- Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)grypeCVE-2026-33896EPSS 0.4%
- Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero InputgrypeCVE-2026-33891EPSS 0.6%
- Forge has signature forgery in Ed25519 due to missing S > L checkgrypeCVE-2026-33895EPSS 0.5%
- Forge has signature forgery in RSA-PKCS due to ASN.1 extra fieldgrypeCVE-2026-33894EPSS 0.5%
- form-data: CRLF injection in form-data via unescaped multipart field names and filenamesgrypeCVE-2026-12143EPSS 0.5%
- form-data: CRLF injection in form-data via unescaped multipart field names and filenamesgrypeCVE-2026-12143EPSS 0.5%
- glob CLI: Command injection via -c/--cmd executes matches with shell:truegrypeCVE-2025-64756EPSS 3.1%
- glob CLI: Command injection via -c/--cmd executes matches with shell:truegrypeCVE-2025-64756EPSS 3.1%
- js-yaml: YAML merge-key chains can force quadratic CPU consumptiongrypeCVE-2026-59869EPSS 0.4%
- js-yaml: YAML merge-key chains can force quadratic CPU consumptiongrypeCVE-2026-59869EPSS 0.4%
- linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker textgrypeCVE-2026-59887EPSS 0.3%
- LinkifyIt#match scan loop has quadratic algorithmic complexitygrypeCVE-2026-48801EPSS 0.3%
- lodash vulnerable to Code Injection via `_.template` imports key namesgrypeCVE-2026-4800EPSS 2.6%
- lodash vulnerable to Code Injection via `_.template` imports key namesgrypeCVE-2026-4800EPSS 2.6%
- lodash vulnerable to Code Injection via `_.template` imports key namesgrypeCVE-2026-4800EPSS 2.6%
- minimatch has a ReDoS via repeated wildcards with non-matching literal in patterngrypeCVE-2026-26996EPSS 0.5%
- minimatch has a ReDoS via repeated wildcards with non-matching literal in patterngrypeCVE-2026-26996EPSS 0.5%
- minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsgrypeCVE-2026-27903EPSS 0.5%
- minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsgrypeCVE-2026-27903EPSS 0.5%
- minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsgrypeCVE-2026-27904EPSS 0.5%
- minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsgrypeCVE-2026-27904EPSS 0.5%
- node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator DesynchronizationgrypeCVE-2025-12816EPSS 0.8%
- node-forge has ASN.1 Unbounded RecursiongrypeCVE-2025-66031EPSS 0.4%
- path-to-regexp vulnerable to Denial of Service via sequential optional groupsgrypeCVE-2026-4926EPSS 0.8%
- path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parametersgrypeCVE-2026-4867EPSS 0.5%
- Picomatch has a ReDoS vulnerability via extglob quantifiersgrypeCVE-2026-33671EPSS 0.4%
- PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosuregrype
- Preact has JSON VNode Injection issuegrypeCVE-2026-22028EPSS 0.2%
- Prototype Pollution via parse() in NodeJS flattedgrypeCVE-2026-33228EPSS 0.8%
- Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()grype
- sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591grype
- shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)grypeCVE-2026-13311EPSS 0.4%
- tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarballgrypeCVE-2025-59343EPSS 0.5%
- tmp has Path Traversal via unsanitized prefix/postfix that enables directory escapegrypeCVE-2026-44705EPSS 0.4%
- Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attackgrypeCVE-2026-27601EPSS 0.6%
- undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reusegrypeCVE-2026-6734EPSS 0.4%
- undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgentgrypeCVE-2026-9697EPSS 0.5%
- undici WebSocket client vulnerable to denial of service via fragment count bypassgrypeCVE-2026-12151EPSS 0.8%
- undici WebSocket client vulnerable to denial of service via fragment count bypassgrypeCVE-2026-12151EPSS 0.8%
- vite: `server.fs.deny` bypass on Windows alternate pathsgrypeCVE-2026-53571EPSS 0.6%
- ws: Memory exhaustion DoS from tiny fragments and data chunksgrypeCVE-2026-48779EPSS 0.8%
- ws: Memory exhaustion DoS from tiny fragments and data chunksgrypeCVE-2026-48779EPSS 0.8%
- Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)semgreppackages/mermaid/src/diagrams/gantt/parser/gantt.spec.js:196
- brace-expansion through 5.0.7 is vulnerable to denial of service via m ...brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps…trivyCVE-2026-14257
- brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexitybrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause sign…trivyCVE-2026-13149
- glob: glob: Command Injection Vulnerability via Malicious FilenamesGlob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names.…trivyCVE-2025-64756
- Image user should not be 'root'Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.trivyDockerfile:3
- minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patternsminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-a…trivyCVE-2026-27903
- minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressionsminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), wh…trivyCVE-2026-27904
- minimatch: minimatch: Denial of Service via specially crafted glob patternsminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal charact…trivyCVE-2026-26996
- picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patternsPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when c…trivyCVE-2026-33671
- PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure## Vulnerability Details **File**: `lib/previous-map.js` **Line**: 87-98 (`loadFile`), 129-144 (`loadMap`) ### Root Cause PostCSS auto-detects a `/*# sourceMappingURL=... */` comment inside the CSS text it is asked to parse and, unless the caller explicitly passes `map: false`…trivy
This report is public.