Mermaid-js mermaid versions before 10.9.6 and between 11.0.0-alpha.1 and 11.15.0 contain a denial-of-service vulnerability (CWE-835) caused by an infinite loop when rendering gantt charts that exclude all dates using the excludes attribute. The vulnerability manifests during the rendering phase when ganttDb.getTasks() is called, not during parsing. This can cause the application to hang or crash due to the loop with an unreachable exit condition. The issue is resolved in versions 10.9.6 and 11.15.0.

An attacker can cause a denial-of-service condition by crafting gantt charts that exclude all dates, triggering an infinite loop during rendering. This can lead to application unavailability or resource exhaustion. There is no indication of code execution or data compromise. No known exploits have been reported in the wild.

Upgrade mermaid-js mermaid to version 10.9.6 or later, or 11.15.0 or later, where this vulnerability is fixed. Since this is a client-side JavaScript library, applying the update is the primary remediation. No other mitigations are indicated.