XSS in Mermaid-js Mermaid
CVE-2025-54881
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 10.9.0-rc.1 to 11.9.0, user supplied inp…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.000 (7.9th percentile) — read the EPSS interpretation.
Affected products
- Mermaid-js Mermaid — versions >= 10.9.0-rc.1, <= 11.9.0
Weakness classification (CWE)
References
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh (x_refsource_CONFIRM)
- https://github.com/mermaid-js/mermaid/commit/5c69e5fdb004a6d0a2abe97e23d26e223a059832 (x_refsource_MISC)
- https://github.com/mermaid-js/mermaid/commit/685516a85ec1df64cefd4fd15f26533be87d458e (x_refsource_MISC)