Cross-Site Scripting Vulnerability in Node-Mermaid Package
Summary
CVE-2025-54880: Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Affects node-mermaid across 2 version ranges.
< 2aa83302795183ea5c65caec3da1edd6cb4791fc
< 734bde38777c9190a5a72e96421c83424442d4e4
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-Mermaid is a JavaScript-based diagramming and charting tool that allows users to create and modify complex diagrams using Markdown-inspired text definitions. It is widely used for generating architecture diagrams and flowcharts in web applications. However, versions 11.9.0 and earlier have a critical vulnerability that exposes user input to potential cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the way user-supplied input for architecture diagram icons is handled in the default configuration of Node-Mermaid versions 11.9.0 and earlier. Specifically, this input is passed directly to the d3 html() method, creating a sink for cross-site scripting. Attackers can exploit this vulnerability to inject malicious scripts, potentially leading to unauthorized access, data theft, or other malicious actions within the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize user input before passing it to the d3 html() method to prevent XSS attacks. This can be done using libraries like DOMPurify to clean the input. Example code:
const cleanInput =
DOMPurify.
sanitize(userInput);
Conclusion
The cross-site scripting vulnerability in Node-Mermaid poses a significant risk to applications using versions 11.9.0 and earlier. It is crucial to update to version 11.10.0 or later to mitigate this risk. Additionally, employing input sanitization can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for node-mermaid →
FAQ
The vulnerability is a cross-site scripting (XSS) issue that allows attackers to inject malicious scripts through user input.
Versions 11.9.0 and earlier of Node-Mermaid are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Update Node-Mermaid to version 11.10.0 or later to secure your application against this vulnerability.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-mermaid.
