CVE-2025-54881: Mermaid XSS Vulnerability in Sequence Diagram Labels
Summary
CVE-2025-54881: Mermaid improperly sanitizes sequence diagram labels leading to XSS. Affects mermaid across 2 version ranges.
>= 10.9.0-rc.1, < 10.9.4
>= 11.0.0-alpha.1, < 11.10.0
Fixed in 10.9.4 or 11.10.0, depending on the release line you run. How to fix ↓
Also tracked for
- node-mermaid · Debian:11
The same CVE-2025-54881 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mermaid is an open-source JavaScript library that enables the generation of diagrams and flowcharts from text. It is widely used for visualizing complex data structures and processes in a simple, readable format. The library supports various diagram types, including flowcharts, sequence diagrams, and Gantt charts. However, in version 11.9.0, a vulnerability was discovered that allows for cross-site scripting (XSS) attacks through unsanitized user input in sequence diagram labels.
Vulnerability Detail
In the default configuration of Mermaid 11.9.0, user-supplied input for sequence diagram labels is directly passed to the innerHTML property during the calculation of element size. This allows malicious users to inject arbitrary HTML, leading to XSS vulnerabilities. The issue arises in the calculateMathMLDimensions method, where the text containing KaTeX delimiters is rendered without proper sanitization. This vulnerability can be exploited by rendering a specially crafted diagram that includes malicious scripts.
How To Fix
Latest published version: 12.2.0 as of 22 Oct 2026
npm install mermaid@12.2.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 10.9.0-rc.1, < 10.9.410.9.4npm install mermaid@10.9.4 -
>= 11.0.0-alpha.1, < 11.10.011.10.0npm install mermaid@11.10.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot update to the patched version immediately, consider sanitizing the input for sequence diagram labels before passing it to the Mermaid library. You can use a library like DOMPurify to sanitize the input. Here’s an example of how to do this:
const sanitizedInput = DOMPurify.sanitize(userInput);
Then, use sanitizedInput in your Mermaid diagram definition.
Conclusion
The vulnerability CVE-2025-54881 in the Mermaid library poses a significant risk of XSS attacks through unsanitized sequence diagram labels. It is essential to update to version 11.10.0 or later to mitigate this risk. Additionally, implementing input sanitization can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for mermaid →
FAQ
CVE-2025-54881 is a vulnerability in the Mermaid library that allows for cross-site scripting (XSS) attacks through unsanitized sequence diagram labels.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your package-lock.json without any signup.
The primary risk is that an attacker can inject malicious scripts into web pages that render Mermaid diagrams, potentially compromising user data and security.
Yes, you can sanitize user input for sequence diagram labels using libraries like DOMPurify to prevent XSS attacks until you can update to the patched version.
Sanitizing input is crucial to prevent XSS attacks, as it removes or neutralizes potentially harmful scripts from user-supplied data before it is rendered in the browser.
References
Related vulnerabilities
Recent vulnerabilities recorded for mermaid.
