Mermaid-js mermaid versions <=10.9.5 and 11.0.0-alpha.1 through 11.12.0 are vulnerable to CSS injection due to improper sanitization of classDef style strings. The vulnerability occurs because the regex capturing classDef values matches everything up to a newline without restriction, allowing a closing brace to terminate the CSS selector and inject new CSS rules. These injected rules can be used for page defacement, user tracking, and DOM attribute exfiltration. The vulnerability is tracked as CWE-94 (Improper Control of Generation of Code). Fixed versions are 10.9.6 and 11.15.0. A temporary mitigation is to set "securityLevel" to "sandbox" to render diagrams in a sandboxed iframe, preventing exploitation.

Exploitation of this vulnerability allows an attacker to inject arbitrary CSS into pages rendering mermaid diagrams, which can result in page defacement, user tracking through CSS url() callbacks, and exfiltration of DOM attributes. The CVSS 4.0 base score is 5.3 (medium severity), indicating a moderate impact with network attack vector, low complexity, no privileges required, and user interaction needed.

A fix is available in mermaid versions 10.9.6 and 11.15.0. Users and developers should upgrade to these versions to remediate the vulnerability. If immediate upgrading is not possible, setting the "securityLevel" configuration option to "sandbox" will mitigate the issue by rendering diagrams within a sandboxed iframe, preventing CSS injection. There is no indication that no action is required or that the issue is already mitigated without these steps.