XSS Vulnerability in Node-Mermaid Package: CVE-2025-54881
Summary
CVE-2025-54881: Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Affects node-mermaid across 2 version ranges.
< 5c69e5fdb004a6d0a2abe97e23d26e223a059832
< 685516a85ec1df64cefd4fd15f26533be87d458e
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-Mermaid is a JavaScript-based diagramming and charting tool that allows users to create and modify complex diagrams using Markdown-inspired text definitions. It is widely used for generating flowcharts, sequence diagrams, and other visual representations of data. The package is particularly valued for its ease of use and integration capabilities within web applications. However, versions 10.9.0-rc.1 to 11.9.0 of Node-Mermaid are vulnerable to a cross-site scripting (XSS) attack due to improper handling of user input.
Vulnerability Detail
The vulnerability arises from the way user-supplied input for sequence diagram labels is processed. In the affected versions, this input is directly passed to innerHTML during the calculation of element size, which can lead to the execution of arbitrary JavaScript code in the context of the user's browser. This XSS vulnerability can be exploited by an attacker to inject malicious scripts, potentially compromising user data and application integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize user inputs before passing them to the diagram rendering function. This can be done by escaping HTML characters in the input string to prevent the execution of any embedded scripts. For example, you can use a function like this:
function sanitizeInput(input) {
return input.replace(/</g, '<').replace(/>/g, '>');
}
Conclusion
In summary, CVE-2025-54881 presents a significant XSS vulnerability in the Node-Mermaid package, which can be exploited if user inputs are not properly sanitized. It is crucial to update to the latest version of the package to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for node-mermaid →
FAQ
CVE-2025-54881 is a cross-site scripting (XSS) vulnerability found in the Node-Mermaid package, affecting versions 10.9.0-rc.1 to 11.9.0.
If exploited, this vulnerability can allow attackers to execute arbitrary JavaScript in the context of your users' browsers, potentially leading to data theft or session hijacking.
The affected versions are from 10.9.0-rc.1 to 11.9.0.
You can check if your application is affected by using tools like Vulert, which monitors open-source vulnerabilities in your software using a manifest file.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities without needing to access the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-mermaid.
