Mermaid does not properly sanitize architecture diagram iconText leading to XSS
Priority MEDIUM 56CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting. This vulnerability is fixed in 11.10.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0041 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed mermaid (mermaid-js): 11.10.0mermaid (npm): 11.10.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mermaid-js | mermaid | 11.1.0 to before 11.10.0 | 11.10.0 | Patch available | CNA |
| — | mermaid (npm) | 11.1.0 to before 11.10.0 | 11.10.0 | Patch available | GHSA-8gwm-58g9-j8pw |
- mermaid Vendormermaid-js Affected 11.1.0 to before 11.10.0 Fixed in 11.10.0 Patch available CNA
- mermaid (npm) Vendor— Affected 11.1.0 to before 11.10.0 Fixed in 11.10.0 Patch available GHSA-8gwm-58g9-j8pw
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mermaid_project:mermaid:*:*:*:*:*:node.js:*:* | 11.1.0 to before 11.10.0 | Vulnerable | mermaid-js |
- cpe:2.3:a:mermaid_project:mermaid:*:*:*:*:*:node.js:*:* Versions 11.1.0 to before 11.10.0 Vulnerable ·mermaid-js
Remediation
- Fix · CNA mermaid (mermaid-js) Fixed in 11.10.0
- Fix · GHSA-8gwm-58g9-j8pw mermaid (npm) Fixed in 11.10.0 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2025-54880
- 2026-10-03 Alias added: GHSA-8gwm-58g9-j8pw
References
More mermaid-js Mermaid vulnerabilities
- TI-2026-29778 Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS CVSS 4.0MEDIUM 5.3
- TI-2022-13152 Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js CVSS 3.1MEDIUM 6.1
- TI-2021-19667 Incorrect sanitisation function leads to `XSS` CVSS 3.1HIGH 7.2
- TI-2021-14247 Mermaid before 8.11.0 allows XSS when the antiscript feature is used. CVSS 3.1MEDIUM 6.1
- TI-2026-29785 Mermaid: Improper sanitization of configuration leads to CSS injection CVSS 4.0MEDIUM 5.3
Sources
- CVE-2025-54880 · CVE Program
- CVE-2025-54880 · NVD
- FIRST EPSS
- GHSA-8gwm-58g9-j8pw · GitHub Advisory Database · CC BY 4.0
- CVE-2025-54880 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences