Previous releases of Beautiful‑Mermaid allow a user‑controlled Mermaid diagram to inject arbitrary SVG attributes or elements when the style and classDef directives are rendered, because the library does not escape values interpolated into SVG attribute contexts. This unsanitized injection can break out of an attribute value, resulting in script execution inside the context of any web page that embeds the produced SVG. The weakness corresponds to input validation failure (CWE‑79).

The vulnerable product is Beautiful‑Mermaid from Lukilabs, versions prior to 0.1.3. No other vendors or product variants are listed as affected.

The CVSS base score is 5.3, indicating moderate impact. The EPSS score is below one percent, suggesting a low current likelihood of exploitation. The vulnerability is not present in the CISA Known Exploit Vulnerabilities catalog. Exploit requires an attacker to supply a crafted Mermaid diagram that is rendered by an application or user that embeds the resulting SVG, implying that remote exploitation would need a vulnerable host that processes user‑controlled Mermaid content.