An infinite loop occurs when a Mermaid Gantt chart uses the excludes attribute to remove all dates, causing the rendering engine to stall. This leads to a denial of service, consuming CPU until the process is terminated or the application times out. The CVSS score of 5.3 indicates moderate severity and reflects the effect on availability rather than confidentiality or integrity.

The vulnerability affects the mermaid-js/mermaid library in all releases prior to 10.9.6 and 11.15.0. Updating to either of those patched versions removes the vulnerable code path.

The issue is exploitable by embedding a Gantt chart that specifies an empty excludes list in a web page or application that renders Mermaid diagrams. Attackers can trigger the loop without requiring authentication or elevated privileges, resulting in an application slowdown or crash. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA's KEV catalog, suggesting no widespread exploitation yet but still a legitimate risk for served content.