Mermaid Radar Diagrams can accept arbitrarily large values for the ticks parameter, which causes the rendering engine to consume excessive CPU resources and can freeze the webpage or JavaScript process for extended periods. The weakness stems from inadequate input validation (CWE-1322), unchecked user input (CWE-606), and uncontrolled resource consumption (CWE-1050), allowing an attacker-controlled diagram definition to trigger a denial of service. The impact is limited to the context where a vulnerable Mermaid instance renders the diagram, potentially disrupting user experience or exhausting memory if the process is killed for resource exhaustion.

The vulnerability affects mermaid-js:mermaid versions 11.6.0 through 11.16.1. Versions prior to 11.6.0 and 11.16.1 or later are not impacted. Affected users should verify the installed version against the range and apply the patch when available.

With a CVSS score of 5.3 the risk is considered moderate. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, which suggests no widespread exploitation yet. The exploit is generally local or remote via a malicious diagram; an attacker can embed a large ticks value in a document or webpage that a user’s browser renders, leading to high CPU usage and a denial of service for that user. In high-traffic scenarios, the cumulative effect could degrade service quality for many users at once.