p PatchFirst

CVE-2025-54880

CVE-2025-54880 · Mermaid does not properly sanitize architecture diagram iconText leading to XSS

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting. This vulnerability is fixed in 11.10.0.

CVSS 5.1 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • mermaid

    Versions
    • >= 11.1.0, < 11.10.0: Affected

    No fix published

  • mermaid npm

    Affected ranges
    • SEMVER: ≥ 11.1.0, < 11.10.0

    Update to 11.10.0

  • node-mermaid Ubuntu:22.04:LTS

    Versions
    • 8.7.0+ds+~cs27.17.17-3
    • 8.13.3+ds+~cs26.13.21-1
    • 8.13.3+ds+~cs26.13.21-2
    • 8.13.8+~cs10.4.16-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-mermaid Ubuntu:26.10

    Versions
    • 9.2.2+~2.0.0-1
    • 9.2.2+~2.0.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →