Mermaid, a JavaScript tool for creating diagrams from Markdown-inspired text, has a vulnerability classified as CWE-94 (Improper Control of Generation of Code) that allows CSS injection. Specifically, prior to versions 10.9.8 and 11.16.1, Mermaid generates sibling combinator selectors from user-supplied diagram class or id names without proper sanitization, enabling an attacker who can supply diagram text to inject arbitrary CSS into the rendered page. This can affect unrelated page elements' appearance or behavior. The issue is resolved in versions 10.9.8 and 11.16.1.

An attacker able to supply diagram text can inject arbitrary CSS into pages rendered by vulnerable Mermaid versions, potentially manipulating the visual presentation or behavior of unrelated elements on the page. This could lead to UI manipulation or visual spoofing but does not directly indicate code execution or data compromise. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and limited impact on confidentiality, integrity, and availability.

Upgrade Mermaid to version 10.9.8 or later, or 11.16.1 or later, where this CSS injection vulnerability is fixed. No other mitigation is indicated or required according to the available data.