v10.9.6

matrixleons/evilwafv10.9.6May 11, 2026by aloisklink

AI Summary

Backports multiple security fixes from Mermaid v11.15.0, addressing vulnerabilities related to Gantt loops, CSS styles, and CSSOM usage.

Key Highlights

Fixes CVE-2026-41150: Limit loop if excluding all dates in Gantt charts
Fixes CVE-2026-41148: Prevents unbalanced CSS styles in classDefs
Fixes CVE-2026-41159: Blocks stylis scope escape
Loosens `uuid` dependency range to allow v14

Full Release Notes

Backports the following security fixes from [Mermaid v11.15.0][]:

- [CVE-2026-41150](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh): **fix(gantt): limit loop if excluding all dates** (a59ea56174712ee5430dfd5bc877cb5151f501a6)
- [CVE-2026-41148](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r): **fix: prevent unbalanced CSS styles in classDefs** (8fead23c59166b7bab6a39eac81acebee2859102)
- [CVE-2026-41149](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr): **fix: create CSS styles using the CSSOM** (4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3)
- [CVE-2026-41159](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p): **fix: block stylis scope escape** (a9d9f0d8eb790349121508688cd338253fd80d76)
- CVE-2026-41907: **fix: loosen `uuid` dependency range to allow v14**
  We don't use this vulnerable code, but it allows users to silence this warning.
  (e8c70434520dd9226bd442f857970cd211067627)

And other dependency updates.

[Mermaid v11.15.0]: https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0

**Full Changelog**: https://github.com/mermaid-js/mermaid/compare/v10.9.5...v10.9.6