Back to Database
Status published
Medium
CVE-2025-54881
Mermaid improperly sanitizes of sequence diagram labels leading to XSS
Vulnerability Description
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 10.9.0-rc.1 to 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54881
Credits & Attribution
No credits recorded in the NVD database.
References
More from mermaid-js
View All →CVE-2025-54880
Mermaid does not properly sanitize architecture diagram iconText leading to XSS
Medium
5.1
CVE-2024-38527
Cross-site Scripting in ZenUML
Medium
5.4
CVE-2022-31108
Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js
Medium
4.1
CVE-2021-43861
Incorrect sanitisation function leads to `XSS`
High
7.2
Affected Vendor
mermaid-js
View all reports →Affected Software
mermaid
Vulnerable Versions:
>= 10.9.0-rc.1, <= 11.9.0
Timeline
Official Publish:
August 19th, 2025
Last Modified:
August 19th, 2025
Added to House:
July 22nd, 2026