Cross-Site Scripting Vulnerability in Mermaid Diagramming Tool by Mermaid
CVE-2025-54881
5.3MEDIUM
What is CVE-2025-54881?
A Cross-Site Scripting (XSS) vulnerability has been identified in the Mermaid diagramming tool that affects versions from 10.9.0-rc.1 to 11.9.0. This issue arises from the handling of user-provided input for sequence diagram labels, which is incorrectly processed and passed directly to innerHTML. This oversight allows attackers to inject malicious scripts that could execute in the context of the user's browser, posing severe security risks. It is crucial for users of affected versions to apply the necessary updates and patches to mitigate this vulnerability.
Affected Version(s)
mermaid >= 10.9.0-rc.1, <= 11.9.0