mermaid

Markdown-ish syntax for generating flowcharts, mindmaps, sequence diagrams, class diagrams, gantt charts, git graphs and more.

Latest 12.2.0

NPM

95%

Total Score

healthy

Active, well-supported release with strong provenance; workflow secret inheritance is the main hygiene concern.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 24 workflows were analyzed without failures; most use read-only permissions and only one of 98 action references is unpinned. High-confidence findings include reusable-workflow secret inheritance and ad hoc package installation, while the cache findings are low-confidence hygiene signals.

Vulnerabilities

Title	Versions	Severity
CVE-2026-71439 mermaid is vulnerable to Unchecked Input for Loop Condition in versions 11.6.0 - 11.16.1.	11.6.0 - 11.16.1	Medium
CVE-2026-71438 mermaid is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 11.0.0-alpha.1 - 11.16.1 and 0.0.0 - 10.9.8.	0.0.0 - 10.9.811.0.0-alpha.1 - 11.16.1	Low
CVE-2026-50159 mermaid is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 11.0.0-alpha.1 - 11.16.1 and 0.0.0 - 10.9.8.	0.0.0 - 10.9.811.0.0-alpha.1 - 11.16.1	Medium
CVE-2026-71437 mermaid is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 11.5.0 - 11.16.1.	11.5.0 - 11.16.1	Medium
CVE-2026-71436 mermaid is vulnerable to Loop with Unreachable Exit Condition ('Infinite Loop') in versions 10.6.0 - 10.9.8 and 11.0.0-alpha.1 - 11.16.1.	10.6.0 - 10.9.811.0.0-alpha.1 - 11.16.1	Medium

Package versions

Maintainers

Direct Dependencies

Dependency	Last Release	Score
d3 Version ^7.9.0	—	—
uuid Version ^11.1.0 \|\| ^12 \|\| ^13 \|\| ^14.0.0	—	—
dayjs Version ^1.11.21	—	—
elkjs Version ^0.9.3	—	—
katex Version ^0.18.0	—	—