XSS in Mermaid-Js Mermaid
CVE-2025-54881
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 10.9.0-rc.1 to 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.008 (53.4th percentile) — read the EPSS interpretation.
Affected products
- Mermaid-js Mermaid — versions >= 10.9.0-rc.1, <= 11.9.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)